Manage Default File Associations in Intune for Windows

Setting default file associations in Intune used to be one of those annoying tasks you only tackled when absolutely necessary. Back then, we had to export an XML file, wrap it in a custom OMA-URI, and cross our fingers that Windows respected the policy.

Thankfully, those days are mostly over.

With the Settings Catalog, we now have a much cleaner way to manage this—no more dealing with CSP strings. That said, we’re not completely free: you still need to Base64-encode your XML file. But it’s miles better than the old way.

In this post, I’ll walk you through how I handle this in customer environments. Step-by-step, real-world, and without the fluff.

Table of Contents

• Why I Use the Settings Catalog
• Step 1: Export the File Associations XML
• Step 3: Create the Profile in Intune
• Step 4: Configure the Setting in the Catalog

Why I Use the Settings Catalog

I always recommend using the Settings Catalog where possible. It brings several advantages:

• No manual OMA-URI definitions
• Easier to read, edit, and troubleshoot
• Native Intune reporting
• Less error-prone and more maintainable

Even though you still need to Base64-encode the XML file, using the Settings Catalog just feels more modern and reliable.

💬 My take? Unless you're doing something super custom, don’t bother with OMA-URI anymore. The catalog is your friend.

Step 1: Export the File Associations XML

Set up a reference machine with all your default apps assigned (e.g. Adobe Reader for .pdf, Chrome for .html, etc.). Then, run the following command in PowerShell as admin:

Dism /Online /Export-DefaultAppAssociations:"C:\DefaultFileAssociations.xml"

This exports the current file associations. Here's a snippet of what you might see (probably with a lot more lines):

<?xml version="1.0" encoding="UTF-8"?>
<DefaultAssociations>
  <Association Identifier=".ps1" ProgId="VSCode.ps1" ApplicationName="Visual Studio Code" />
  <Association Identifier=".txt" ProgId="AppX4ztfk9wxr86nxmzzq47px0nh0e58b8fw" ApplicationName="Notepad" />
</DefaultAssociations>

You can edit the file manually to remove entries you don’t want enforced.

Step 2: Convert the XML to Base64

Now comes the slightly annoying part. The Settings Catalog setting expects the XML to be pasted in as Base64.
Run this in PowerShell to generate it:

$xmlPath = "C:\DefaultFileAssociations.xml"
[convert]::ToBase64String([IO.File]::ReadAllBytes($xmlPath)) | Set-Clipboard

Step 3: Create the Profile in Intune

1. Head to Intune Admin Center
2. Go to Devices > Configuration profiles > Create profile
3. Choose:
   • Platform: Windows 10 and later
   • Profile type: Settings catalog

Click Create, and give your profile a name like Default File Associations.

Step 4: Configure the Setting in the Catalog

1. On the Configuration settings step, click Add settings
2. Search for: Default Associations Configuration File
3. Add the setting from: Category: Device Configuration > Default Associations Configuration File
4. Paste the Base64 string you copied earlier into the input field.
5. Assign the profile to a group.

📝 Sidenote: This setting was added to the Settings Catalog in May 2023 (Service release 2305). Before that, configuring default file associations required a custom OMA-URI policy using the ./Device/Vendor/MSFT/Policy/Config/Applications/DefaultAssociationsConfiguration CSP.