Account Protection Policy Unable to Save

Likely culprits, in order of probability:

1. Known Account Protection UI bug – the consolidated blade sometimes throws generic save errors even on valid configs, especially after a recent service release. Given the timing, this looks more like a platform issue than your setup.
2. Check Service Health – Admin Center → Tenant administration → Message center/Service health for active Intune advisories.
3. Workaround: use Settings Catalog instead – same WHfB settings, usually saves fine when the Account Protection blade won't.
4. Try incognito/different browser – rules out stale cached JS from a recent backend update.
5. Watch for tenant-wide WHfB policy conflicts – once it saves, make sure Devices → Enrollment → Windows Hello for Business isn't also configured, or it can override your "allow, don't enforce" intent.

If you can grab the actual error code from the browser's dev console (Network tab, failed POST), that'd help pin it down faster.

Likely culprits, in order of probability:

1. Known Account Protection UI bug – the consolidated blade sometimes throws generic save errors even on valid configs, especially after a recent service release. Given the timing, this looks more like a platform issue than your setup.
2. Check Service Health – Admin Center → Tenant administration → Message center/Service health for active Intune advisories.
3. Workaround: use Settings Catalog instead – same WHfB settings, usually saves fine when the Account Protection blade won't.
4. Try incognito/different browser – rules out stale cached JS from a recent backend update.
5. Watch for tenant-wide WHfB policy conflicts – once it saves, make sure Devices → Enrollment → Windows Hello for Business isn't also configured, or it can override your "allow, don't enforce" intent.

If you can grab the actual error code from the browser's dev console (Network tab, failed POST), that'd help pin it down faster.

This is usually one of a few things — worth checking in this order since the errors are generic ("unable to save assignments" + "unable to save policy"):

1. Ignore the Copilot "Insights" failure for now — that's the separate AI policy-review preview service, and its outage doesn't mean your actual save will fail. Don't let that banner distract from the real error.
2. Check the group assignment first. "Unable to save group assignments for WHfB" often points to a stale or still-processing dynamic group, a deleted/renamed group still referenced somewhere, or a group that's too large and timing out. Try saving with All Users/All Devices temporarily — if that saves fine, the issue is the specific group.
3. RBAC/scope tags. If your account has a custom role or scope tag restriction, Intune can throw a generic "unable to save" error instead of a clear permissions message. Confirm the account has full Endpoint Security Manager (or Intune Administrator) rights and the right scope tag on the policy.
4. Browser-side issue. Try an InPrivate window or a different browser — the Intune admin center UI occasionally caches a broken policy state that a fresh session clears.
5. Check Intune service health. Go to Tenant administration > Message center, or the M365 Service Health dashboard — WHfB/Account Protection policy save failures have shown up before during backend service incidents, and they usually resolve without any tenant-side fix.
6. If it's been 24+ hrs and none of the above helps, try creating the same policy via Graph API or PowerShell (Set-MgDeviceManagementConfigurationPolicy or the Graph beta endpoint) — it'll often surface a real error code/message instead of the generic UI banner, which is much easier to search or escalate on.

If you can share the exact error code (not just the generic text) from the browser dev console network tab, that'll narrow it down further.

The screenshot shows three failures: the policy review service cannot be reached, group assignments cannot be saved, and the WHfB policy save fails. Because small device or user-setting changes also fail, this looks more like a portal or Intune service transaction problem than an invalid Windows Hello choice. Check Microsoft 365 Service health and Intune tenant status, then retry in a browser window with an Intune administrator. Create a minimal test policy with one setting and no assignment; if it saves, add the assignment and settings separately to identify the failing stage. Review Tenant administration > Audit logs for the failed operation, timestamp, actor, and result. Verify the administrator has Intune RBAC permissions and scope tags for the policy and target group. Do not keep editing the policy while errors persist. If the minimal policy fails, capture the time, tenant ID, screenshot, and details and open an Intune support request.

I am not aware of any ongoing issues, but have to tried assigning to the built-in virtual groups in Intune?