Baselines
Hardening that doesn't surprise your users
Baselines arrive unassigned and you read every setting first. MDO's CIS v5 sets, coming next, also keep settings that break Autopilot out of the first pass.
CIS v4 and v5, in one paragraph
The sets you can deploy today follow CIS Benchmark v4.0. The Compliance page scores your tenant against the newer CIS v5.0.0. MDO's own CIS v5 sets, called MDO Hardening, are on the Baselines page now so you can read every policy and setting, and deploying them is coming next. Until then, deploy the v4 sets and use the v5 score to see what's left.
Deployable today: MDO's CIS sets
Nothing reaches a device until you decide. MDO creates each set as new Settings Catalog policies (Intune's current policy format) with no assignments. On the MDO CIS tab of the Baselines page you see a preview of the policies a set will create, then create them, and you can read every setting in MDO's policy viewer before you assign anything in Intune. Deploying needs the Admin or Owner role.
- CIS L1 Core
- 10 policies, 301 settings
- CIS L2 Enhanced
- L1 Core plus one L2 policy, 353 settings
- CIS BitLocker
- 1 policy, 16 settings
- CIS Edge
- 1 policy, 80 settings
- CIS Privacy & UX
- 1 policy, 26 settings
Level 1 or Level 2?
Level 1 is a sensible baseline most organisations can run without users noticing much. Level 2 is stricter, meant for higher-risk users and devices, and can get in the way of everyday work, so try it on a pilot group first.
Built so Autopilot keeps working: MDO Hardening on CIS v5
A hardening baseline that breaks Autopilot means rebuilding devices. MDO Hardening is MDO's build of CIS Microsoft Intune for Windows 11 v5.0.0: Level 1, a Level 2 add-on and BitLocker. Settings that break Autopilot are kept out of Level 1 and recorded as accepted deviations, which the Compliance page shows.
Its card on the Baselines page lists each policy and how it's meant to be assigned. Device policies go to all devices, and settings that would reboot a device during Autopilot wait until after enrollment. User policies go to all users. Each assignment is narrowed by an assignment filter, not a device group.
Today the card is read-only and says Available after lab validation.
Coming: OpenIntuneBaseline, MDO CIS, or both
Many tenants already run OpenIntuneBaseline (OIB). Some only want CIS hardening. MDO will offer three starting points:
- OIB as the full build, which we recommend.
- MDO CIS alone, for organisations that want CIS hardening and nothing else.
- OIB plus CIS gap-fill: OIB, and then Fix adds only the CIS controls OIB leaves out.
Where your tenant already sets a different value, Fix shows the policy that sets it and lets you choose. The Baselines page lists OIB policies by version today. Deploying them from MDO is being proven on a test tenant, so it isn't listed as available yet.
Read the baselines docsFree during the private beta. Tell us about your tenant and Aaron will get back to you.