Checking CIS Benchmarks in a spreadsheet or automatically

How the manual check works

CIS publishes benchmarks written for Intune, and states that the PDFs are free for non-commercial use. A typical manual check goes like this:

• Pick the benchmark, its version and the Level you want to meet, and copy its recommendations into a spreadsheet.
• For each recommendation, find the Intune setting it describes. The benchmark names a Settings Catalog path, but your tenant may set the same thing in another policy type.
• Search every policy that could configure it, note the value and whether the policy is assigned, and mark the row as passing, failing or missing.
• Record each recommendation you deliberately do not follow, with a reason, an owner and a review date.
• Fix what fails, then repeat the whole check after the next change or the next benchmark version.

Side by side

What TenuVault checks automatically

For each certified Level, TenuVault checks most recommendations automatically and lists the rest for a manual check, with their CIS description, audit and remediation text when the delivered list includes it.

TenuVault is CIS Benchmarks Certified for Assessment and Remediation. The certification covers only the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 (Level 1), CIS Microsoft Intune for Microsoft Defender Antivirus Benchmark v1.0.0 (Level 1 and Level 2) and CIS Apple macOS 26 Tahoe Intune Benchmark v1.0.0 (Level 1 and Level 2). The certification belongs to TenuVault, not to your tenant: an assessment compares your Intune configuration with the benchmark pack and does not certify your tenant's compliance.

• CIS Benchmarks

How remediation works, and where it stops

From the results you select failing settings and plan a remediation. TenuVault shows every policy it would create or change, reads the tenant again when you approve, runs a backup and records the current state of every policy it changes, then writes and reads each change back. A rollback is a new change set built from that recorded state.

TenuVault remediates only the recommendations it assesses automatically through Intune policy settings. It lists Manual and not assessed recommendations with their CIS guidance for manual action.

• Missing settings are created in new policies with no assignments, so nothing takes effect until an administrator assigns them.
• Different settings are changed in place in the policies that hold them. Those policies keep their assignments, so the change reaches their devices.
• A rollback cannot write back values that Intune masks, such as encrypted OMA-URI values; the rollback preview names those policies.
• Remediation changes Intune configuration only. It does not confirm that devices apply the settings.

• Change sets

When you do not need TenuVault

A spreadsheet is the better choice when:

• You need a benchmark, version or Level outside the certified scope, such as the Windows 10, Edge or Office benchmarks.
• Your settings live mostly in Administrative Templates, custom OMA-URI profiles or older profile types, which the TenuVault assessment would report as Missing.
• You check a small set of recommendations once, for example for a single audit question.
• You are on Community and do not plan to use Pro or MSP for anything else.
• What you need is evidence of what devices actually apply. Use a device-side assessment for that, with or without TenuVault.

When TenuVault saves you time

An automated assessment is worth it when:

• You check the same benchmark again after changes, or across several tenants, and the research takes days each time.
• Your CIS settings are in Settings Catalog policies, as the Intune benchmarks describe them.
• You want failing settings fixed through a reviewed change with a backup and a rollback, not by editing policies by hand.
• Auditors expect a dated report with exceptions, owners and the limits of the check stated.

Using both

The two fit together. Use the TenuVault assessment for the recommendations it checks automatically, and keep a short spreadsheet for the Manual and not assessed recommendations it lists, for settings you configure outside the Settings Catalog and for anything you check on devices.

CIS content delivered to TenuVault may be used within TenuVault and in the reports and exports it produces, and shared within your organization and with your auditors. It may not be published or redistributed.

CIS, CIS Benchmarks and CIS Controls are trademarks of the Center for Internet Security, Inc.

• How to use CIS Benchmarks with Microsoft Intune
• Compare Intune with security frameworks