I needed to change a Intune VPN profiles, because I needed more networks in our Split tunneling setup.

Unfortunately, after the creation of the extra subnets, the changes did get pushed to devices.
I found out, that if you just change the description of the Intune devices configuration, all devices status was set to pending, and started re-enrolled of the device configuration.

So just edit the description, e.g you can add a small changelog in the description.