跳到主要內容

158: MDM based policies for security baselines

Implementation Effort: Medium
User Impact: Low to Medium

Overview​

Security baselines in Microsoft Intune are Microsoft-maintained collections of recommended settings for Windows, Microsoft Edge, and other supported workloads. In a Zero Trust program, baselines provide a fast way to establish a hardened starting point before layering environment-specific exceptions and additional controls.

Baselines should not be treated as a one-time import. Admins should review the baseline version, compare it to organizational standards, test for app or workflow impact, and use reporting to identify conflicts with other device configuration, endpoint security, or settings catalog policies.

Implementation Guidance​

Plan the baseline strategy​

  • Identify which baseline types are relevant, such as Windows, Microsoft Edge, or Microsoft 365 Apps, and map them to the device populations that should receive them.
  • Compare the recommended settings with internal security standards, regulatory requirements, and any existing Group Policy or configuration management baselines before deployment.
  • Document settings that require exceptions, especially browser settings, credential protections, firewall behavior, or user experience changes that may affect support volume.

Configure and deploy in Intune​

  • In the Microsoft Intune admin center, create a security baseline profile and use Microsoft Entra groups or device filters to target an initial pilot population first.
  • Review every setting that differs from Microsoft defaults; do not assume every recommended value is appropriate for all business units or device types.
  • Avoid duplicating the same setting in multiple places. If a setting is also managed through endpoint security, settings catalog, or another profile, decide which policy should remain authoritative.

Operate and validate​

  • Review per-setting status and device assignment reports to identify failures, conflicts, and unsupported settings.
  • Revisit baselines after major Windows releases and after Microsoft publishes newer baseline versions, then retest before broad rollout.
  • Track approved exceptions separately so that baseline drift does not become invisible over time.

Reference​