Creating custom policy templates

Applies to: Conditional Access, Defender, Intune, Purview
Where to find it: Secure → (module) → Templates
You need: Secure module manage permission, plus the SKU for the module you are working in

Augmentt ships a library of Augmentt Default templates. They are shared across every organisation on the platform, which is why you cannot edit or delete them — the Edit and Delete actions simply do not appear on a default template's row menu.

To build on one, you copy it. Duplicating a default produces a template your organisation owns, and that copy is fully editable.

Two ways to create a custom template

Both produce the same thing: a template owned by your organisation, listed alongside the Augmentt Defaults, deployable to any customer.

Method 1 — Duplicate an existing template

This is the fastest route and works identically in every module.

1. Go to Secure → (module) → Templates.

2. Find the template you want to base yours on. It can be an Augmentt Default or one you already own.

3. Open the row's ⋯ menu and choose Duplicate.

4. A new template appears immediately, named <original name> (copy).

5. Open the ⋯ menu on the copy and choose Edit. Rename it, rewrite the description, and change whatever settings you need.

What gets copied

Duplicating carries across the template's entire policy body — every setting, condition and control, exactly as the original defines it — along with its description. Nothing is trimmed or reset.

The one thing that changes is ownership. The copy belongs to your organisation, which is what makes Edit and Delete available on it.

Watch the name. Every duplicate is called (copy) until you rename it, so duplicating twice from the same source gives you two identically-named templates. Rename immediately.

Method 2 — Create from a live customer policy

Each module's Templates page has a New template action that reads a policy out of a customer's tenant and turns it into a reusable template.

1. Go to Secure → (module) → Templates and choose to create a new template.

2. Select the customer whose tenant holds the policy you want to capture.

3. Select the policy. Augmentt reads the tenant's live policies and lists the ones eligible to

become templates.

1. Give the template a name and description. Neither is inherited from the source policy, so

write something your team will recognize months from now.

1. Save. The template is stored against your organization and is immediately deployable to any

other customer.

This is the "golden tenant" pattern: configure one tenant exactly the way you want, capture it, then roll it out to the rest of your base.

The captured policy is a snapshot. It records the settings as they were at the moment you captured them. Later changes in the source tenant do not flow into the template, and changes to the template do not flow back. Recapture when the golden tenant moves on.

Module-specific notes

Conditional Access

Secure → Conditional Access → Templates — 46 Augmentt Default templates across three libraries: the core Augmentt set, CIS Microsoft 365 v6, and NIST CSF 2.0.

Two things carry into a duplicate and matter more here than elsewhere:

• Report-only state. Every Augmentt Default CA template deploys in report-only mode. Your copy inherits that, which is what you want — deploy the copy, read the sign-in logs, then enforce.

• Prompted inputs. Templates that ask for values at deployment (break-glass accounts to exclude, Named Locations to block, trusted locations to allow) keep those prompts in the copy. A template such as Block Risky Countries or IPs holds no locations of its own; it is inert until you supply them at deploy time, and that stays true of the duplicate.

Creating from a live policy reads the selected customer's existing Conditional Access policies.

Defender

Secure → Defender → Templates — 7 Augmentt Default templates covering anti-phishing, anti-spam (inbound and outbound), anti-malware, Safe Attachments and Safe Links.

When creating from a live policy you pick the policy type first, then the policy. Two behaviours to know:

• Microsoft's built-in policies are filtered out of the list. Only policies someone actually created in the tenant can become templates — the built-in defaults cannot.

• The policy is trimmed on capture. Augmentt keeps the settings that define the policy's behaviour and discards tenant-specific metadata, so the template is portable to other customers rather than carrying one tenant's identifiers around.

Intune

Secure → Intune → Device Management → Configuration → Templates (and the Compliance, Platform Scripts and Remediation Scripts tabs beside it, plus App Management and Onboarding → Templates). Intune has the widest template surface — device configuration, device compliance, Autopilot deployment profiles, apps, app protection, app configuration, scripts and remediation scripts each have their own Templates page, and each behaves the same way.

31 Augmentt Default templates ship across three of those areas: 26 device configuration, 3 device compliance, and 2 Autopilot deployment profiles. The remaining areas have no defaults, so there you start from a live policy or a blank template.

Because Intune templates carry platform-specific settings, duplicate from a template that already targets the right platform. Copying a macOS configuration and editing it into a Windows one is far more work than starting from the Windows equivalent.

Purview

Secure → Purview → Retention → Templates and Secure → Purview → DLP → Templates.

Purview supports custom templates exactly like the other modules, but ships no Augmentt Default templates — there is nothing to duplicate on a fresh tenant. That is deliberate: retention schedules and DLP rules encode a customer's own legal and regulatory obligations, and there is no default that would be safe to apply broadly.

So in Purview you start from a live policy in a tenant you have already configured, or you build one from scratch. Once you have your first template, duplicating it to make variants works normally.

Two cautions specific to Purview:

• Retention is difficult to reverse. Content already under retention cannot be permanently removed until the period lapses, and deleting the policy does not release it. Confirm the schedule with the customer before deploying a template built from it.

• A retention policy needs its rule. The policy says where retention applies; the rule says how long and what happens at the end. Check the rule came across with the policy when you capture a template from a live tenant.

After you have your template

• It appears alongside the Augmentt Defaults on the same Templates page, so your team sees both when choosing what to deploy.

• Creating a template changes nothing in any tenant. Templates are inert until deployed; deployment is a separate step against a chosen customer.

• It can be added to a baseline group, letting you deploy a bundle of templates in one action rather than one at a time.

• Edit it whenever you like — but note that editing a template does not update policies already deployed from it. Redeploy to push changes out.

Troubleshooting

Edit and Delete are missing from the menu. The template is an Augmentt Default, owned by Augmentt rather than your organization. Duplicate it and edit the copy.

The whole row menu is missing. You are in the module read-only. Either your account lacks the Secure manage permission, or the customer's plan does not include that module's SKU.

No policies listed when creating from a live tenant. Either the selected customer has no policies of that type, or the only ones present are Microsoft built-ins, which cannot be captured.

Related

• All Augmentt Default templates

• Purview policies in Augmentt

• Teams policies in Augmentt — Teams has no templates; its policies are edited in place

_Teams is deliberately absent from this article. It is not a template type in Augmentt — every tenant already has Global Teams policies in force, so there is nothing to template or deploy. See the Teams article above._