跳到主要內容

139: Security Baselines

Implementation Effort: Medium – Requires reviewing baseline default settings against organizational requirements and testing across deployment rings.

User Impact: Low – Most baseline settings harden background OS, browser, and application attack surfaces without disrupting standard user workflows.

Overview​

Security baselines in Microsoft Intune are pre-configured groups of settings and default values recommended by Microsoft's product security teams to establish a hardened, Zero Trust posture across Windows, Microsoft Edge, Microsoft 365 Apps, and specialized workloads.

Key 2025–2026 Security Baseline updates in Intune include:

  • Windows 11, version 26H2 Security Baseline (October 2026) and Windows 11, version 25H2 Security Baseline (April/June 2026): Aligns Windows 11 endpoints with the latest Microsoft security recommendations (including Disable Internet Explorer 11 Launch Via COM Automation).
  • Microsoft 365 Apps for Enterprise Security Baseline v2512 (June 2026): Updates Office security posture, including macro signing controls (VBA Macro Notification Settings set to Disable all except digitally signed macros).
  • Microsoft Edge v139 Security Baseline (April 2026): Hardens browser security settings for Microsoft Edge for Business.
  • Windows 365 for Agents Security Baseline (August 2026): Establishes a hardened posture across Windows 11, Edge, and Defender for Endpoint on Windows 365 Cloud PCs running autonomous or agentic workloads.
  • Local AI Agent Baseline – OpenClaw (Preview, June 2026): Dedicated baseline to block unsanctioned local AI agents like OpenClaw on managed Windows endpoints.
  • Microsoft Windows 11 STIG SCAP Benchmark Audit Baseline (June 2026): Audit-only baseline for US Government Community Cloud High (GCC High) tenants (with Advanced Analytics licensing) that evaluates devices against DISA STIG Version 2, Release 7 with NIST XCCDF mapping.
  • Improved Baseline Version Upgrade Experience: When updating an existing baseline profile to a newer version, admins can now choose to Keep customizations (automatically carrying forward organizational overrides into a new profile instance) or Discard customizations (resetting to the new baseline defaults) while leaving the original profile read-only during phased rollout.

Reference​