Security baselines in Intune for Windows

As a starting point for a security baseline, we can use Microsoft's best practices. I always use these baselines when starting a new project or implementation, unless the customer or I have a good reason to go in a different direction. This is all set up at the start of the workshop or while the Pilot is running.

What security baselines is available for Windows?

Because we can use various Device Configurations (DC), I've compiled a list of each possible subject in order of importance when it comes to configuring our Windows devices.

1. Security Baseline
2. Individual settings (Templates or settings catalog)
3. ADMX templates

You can change the baseline version that a specific profile is using. When you update a version, you do not need to create a new baseline profile to take advantage of the new features. Instead, you can select a baseline profile and change the instance version for that profile using a built-in option.

Let's dig into Security Baselines

A security baseline that includes Microsoft's best practice configurations is a good way to get started quickly. Security baselines are pre-configured groups of Windows settings and default values that are recommended by Microsoft's security teams.

Benefits:

• The best practices and recommendations for settings that affect security are part of a security baseline. Intune works with the same Windows security team that makes security baselines for group policy. These suggestions come from advice and a lot of experience.
• If you are new to Intune and don't know where to begin, security baselines can help. You can quickly make and use a secure profile, knowing that you are helping to protect the resources and data of your organization.
• If you use group policy now, these baselines make it much easier to switch to Intune for management. These baselines are built right into Intune and come with a modern way to manage them.

Microsoft recommends that everything related to Endpoint security should be set up in the Endpoint Security blade.

When we take a look at the Intune portal at Endpoint.microsoft.com

Security Baseline for Windows 10 and later (November 2021)

Looking at "Security Baseline for Windows 10 and later" when we create a profile we will see that we have overwhelming many device configurations.

If you choose to toggle and see all subjects, I have marked subjects that I would remove from the baseline and handle myself in a separate policy.

Next up is going to be Microsoft Defender for Endpoint Baseline

Microsoft Defender for Endpoint Baseline (MDE) (December 2020, Version 6) also called MDE

When we create a profile with "Microsoft Defender for Endpoint Baseline," we won't see as many device configurations as we do with "Security Baseline for Windows 10 and later," but the big difference between the two is that our environment has met the requirements for MDE.

If you choose to Toggle and see all subjects I have marked, I would take some of those out of the baseline and handle them myself in a different policy.

Next up is Windows 365 Security Baseline (Preview)

Windows 365 Security Baseline (version 2101)

If you use Windows 365, you should definitely try out this baseline. It's much harder to change security settings once an environment is in production, so I suggest you test this with a small group until Microsoft releases it from preview.

Reminds me of "Security Baseline for Windows 10 and later (November 2021)" becuase i see a lot of similar settings. Lets take a look.

I haven't marked anything because i need more experience with Windows 365 first.

And the last one is Microsoft Edge Baseline

Microsoft Edge Baseline (September 2020 (Edge version 85 and later))

The new Edge browser version 85+, which is based on chromium, is used in almost every production environment. If you're in this group and haven't set up any devices yet, I strongly suggest you start with this baseline.

Lets see what we have inside

We only got one subject

Mixing baselines

You can mix and match all of them except for Windows 365. If you use Windows 365, I suggest that you stick to the baselines for Windows 365.

For Windows 10+, we just need to leave out Windows 365 for a good mix. However, you need to be aware of possible conflicts, so test, test, test, or wait for my next blog, where I will give you the solution. Mixing the baselines for Windows 10+ and MDE.

More information

Learn about Windows security baselines you can deploy with Microsoft Intune

Deploy security baselines to devices to help protect users and data on devices you manage with Microsoft Intune. The default baseline configurations are the recommended windows security settings from the relevant security teams. You can also customize baselines to meet your business requirements.

Microsoft DocsBrenduns