Important
This has been developed as a starting point or foundation and is not necessarily considered "complete". It is being made available to allow learning, development, and knowledge-sharing amongst communities.
No liability is assumed for the usage or application of the settings within this project in production tenants.
James is a Technical Architect and Microsoft MVP in both Intune and Windows, and has been working in the IT industry for over 20 years, with the last 10 being primarily within Intune. He is also a recognised contributor to the CIS Windows Benchmarks. He has a wealth of experience across the Microsoft 365 stack, with a focus on security and compliance, and is a regular attendee and speaker at community events such as MMS and Workplace Ninja Summit, and is passionate about sharing knowledge and helping others.
The OpenIntuneBaseline (OIB) project was started in early 2021 as a way to provide a "known good" baseline security posture for Windows devices managed by Microsoft Intune, after being disappointed with the admin and user experience of other available baselines.
When creating the initial Windows baseline, substantial data analysis was carried out over well-known security frameworks, such as:
- NCSC Device Security Guidance
- CIS Windows Benchmarks
- ACSC Essential Eight
- Intune Security Baselines for Windows, Edge & Defender for Endpoint
- Microsoft Best Practice
The OIB was not created by simply applying the recommendations from these frameworks. While there is obviously significant overlap, I was driven to create something that included a number of user-experience additions not seen in the above frameworks, as well as my own significant experience implementing these across multiple customer environments, and how admin managability can be impacted by doing so.
Security frameworks tend to be seen as unmovable hard requirements rather than what they are, which is a set of recommendations. In fact, the CIS themselves preface their benchmarks with the following:
It is acceptable if 100% of the benchmark is not applied, as it is the responsibility and decision of each organization to determine which settings are applicable to their unique needs.
It is impossible to create a true "one-size-fits-all" set of policies due to the massively differing nature of enterprise requirements. There is also a significant amount of "noise" in the security community, with many recommending settings that are not necessarily required or beneficial, such as enforcing default behaviour that a standard user cannot change, or settings that have been included in GPO baselines since the days of Windows 7.
This baseline is designed to be a starting point or guide, and all configurations applied to an environment regardless of source should be reviewed and adjusted to suit your own business requirements.
That being said, if there's something you feel is missing or should be included, please feel free to raise an issue or submit a PR.
Full documentation for the OpenIntuneBaseline is available at docs.openintunebaseline.com, including importing, versioning, settings guidance, known issues and the FAQ.
| Platform | Release Status | Current Release | Documentation | Change Log |
|---|---|---|---|---|
| Windows | Stable | v4.0 | Link | Link |
| Windows 365 | Unstable | v1.0 | Link | Link |
| MacOS | Unstable Beta |
v1.0 v2.0 Beta |
Link | Link |
| iOS | Beta | v1.0 Beta | Link | - |
| Android | In Development | - | - | - |
| BYOD (App Protection) | Stable | v2.0 | Link | Link |
There are four options to import the baseline. See Importing the baseline for details of each:
- OIB Deployer - My own tool, allowing platform-specific, granular deployment of the baseline, and highlighting missing or updated policies in your tenant.
- TenuVault - Deploys, compares and validates OIB policies in your tenant. Documented separately.
- IntuneManagement - The OG deployment method, and how I still export the majority of baseline policies.
- Native Import - Limited to Settings Catalog policies in the Device Configuration blade.
Each OS has its own folder, with OS-specific files (readme, changelog, baseline JSON's, supporting information etc.) contained within, and is versioned independently. Version numbers primarily follow the format of Major.Minor, occasionally using Major.Minor.Patch if something fits in the "bug fix" category.
The current versions and release channels of every platform are listed in releases.json and on the Releases documentation page. See Versioning and release channels for more information.
All policies follow the same naming convention, for example Win - OIB - Device Security - D - Login and Lock Screen - v3.0. See Policy naming convention for details.
Frequently Asked Questions | docs.openintunebaseline.com
If you have a question that isn't answered there, please raise an issue,post in discussions, or come ask in the WinAdmins Discord