Baselines

The Baselines page (under Intune in the sidebar) has two tabs: OpenIntuneBaseline and MDO CIS.

MDO CIS: the sets you can deploy

The MDO CIS policies follow CIS Benchmark v4.0. They ship with MDO, so nothing is downloaded when you deploy.

Set	What it contains
L1 Core	10 policies: audit policy, user rights, local security options, Windows Firewall, Defender Antivirus, attack surface reduction, remote access, device lock and credentials, event log and network, system hardening. 301 settings.
L2 Enhanced	L1 Core plus one L2 hardening policy with stricter privacy and system restrictions. 353 settings.
BitLocker	One policy covering OS, fixed and removable drive encryption. 16 settings.
Edge	One Microsoft Edge security policy (CIS Edge Benchmark v3). 80 settings.
Privacy & UX	One policy for privacy, notifications, search, connectivity and user experience settings from CIS L1 and L2. 26 settings.

To deploy a set:

1. Pick the target tenant in the tenant switcher.
2. Open Baselines and the MDO CIS tab.
3. Click Deploy on a set. MDO shows a preview of the policies it will create.
4. Confirm to deploy.

Deploying needs the Admin or Owner role. Every policy is created as a new Settings Catalog policy with no assignments, so nothing reaches a device until you assign the policies in Intune. Each deployment is recorded, and a set you’ve deployed before shows Deploy again.

MDO Hardening (CIS v5): read only for now

The MDO Hardening (CIS v5) card on the same tab lists MDO’s sets built on CIS Microsoft Intune for Windows 11 v5.0.0. The sets are Level 1, a Level 2 add-on and BitLocker, split into:

• Device policies, meant for all devices with an assignment filter;
• Device, after ESP policies, for settings that would restart a device during Autopilot’s enrollment status page, so they apply after enrollment;
• User policies, meant for all users with an assignment filter.

The card is marked Available after lab validation and has no Deploy button yet. It becomes deployable once an Autopilot test device completes enrollment with the set applied. The rules where MDO departs from CIS show as Accepted deviation on the Compliance page, never hidden.

OpenIntuneBaseline tab

This tab lists the OpenIntuneBaseline (OIB) policies by version. Deploying OIB from MDO hasn’t been proven against a live tenant yet, so this guide doesn’t cover it.

Coming

MDO will let you choose OIB as the full build, MDO CIS alone, or OIB plus CIS gap-fill. With gap-fill, Fix adds only the CIS controls your policies leave out and shows any conflicting value first. See Coming next.

Checking the result

After the next collection, the new policies appear in Intune › Policies. Once assigned, they count on the Compliance page.