Merge pull request #7018 from MikeDano/patch-1

Update settings-catalog.md

Author: PRMerger12

memdocs/intune/configuration/settings-catalog.md

@@ -191,6 +191,30 @@ The **Templates** include a logical group of settings, such as device restrictio
 
 The **Settings catalog** lists all the available settings. If you want to see all the available Firewall settings, or all the available BitLocker settings, then use this option. Also, use this option if you're looking for specific settings.
 
+## Device scope vs. user scope settings
+
+When selecting settings, some settings have a `(User)` tag or `(Device)` tag in the setting name, such as `Allow EAP Cert SSO (User)` or `Grouping (Device)`. When you see these tags, the policy only affects the user scope or the device scope.
+
+For more information on user scope and device scope, see the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider).
+
+Device and user groups are used when you assign your policies. Device and user scopes describe how a policy is enforced.
+
+When deploying policy from Intune, you can assign user scope or device scope to any type of target group. Behavior of the policy per user depends on the scope of the setting:
+
+- User scoped policy writes to `HKEY_CURRENT_USER (HKCU)`. 
+- Device scoped policy writes to `HKEY_LOCAL_MACHINE (HKLM)`.
+
+When a device checks-in to Intune, the device always presents a `deviceID`. The device may or may not present a `userID`, depending on the check-in timing and if a user is signed in.
+
+These are some possible combinations of scope, assignment, and the expected behavior:
+
+- If a device scope policy is assigned to a device, then all users on that device have that setting applied.
+- If a user scope policy is assigned to a device, then all users on that device have that setting applied. This behavior is like a [loopback set to merge](/troubleshoot/windows-server/group-policy/loopback-processing-of-group-policy).
+- If a user scoped policy is assigned to a user, then only that user has that setting applied.
+- If a device scoped policy is assigned to a user, once that user signs in and an Intune sync occurs, then the device scope settings apply to all users on the device.
+
+If there is no [user hive](/windows/win32/sysinfo/registry-hives) during initial check-ins, then you may see some user scope settings marked as not applicable. This behavior happens in the early moments of a device before a user is present.
+
 ## Next steps
 
 - Be sure to [assign the profile](device-profile-assign.md), and [monitor its status](device-profile-monitor.md).