Intune - Change in Always on VPN profile synced and not synced

andrejochemsen 

Assuming the devices are connected and configured and properly checking in with Intune, in general they should pick up policy changes within a few hours at best, or a few days at worst.

One trick that sometimes helps is to prod at the policy again to save a change which will cause the devices to detect there's a new version they need to download. For example, add another URL into the NRPT, or change some other non-critical setting just to create some entropy.

Otherwise, you might want to check Event Viewer DeviceManagement-Enterprise-Diagnostics-Provider logs on some machines which aren't getting the policy change and see if there's an issue.

Please like or mark this thread as answered if it's helpful, thanks!