TenuVaultDesktopPractical guide
Apply CIS Windows 11 Benchmark with Intune Settings Catalog
Apply CIS Windows 11 Benchmark by choosing the Intune-specific benchmark and profile, comparing its recommendations with existing policy, then deploying reviewed settings to a pilot. In TenuVault, begin with a read-only assessment and plan remediation from its findings. Missing settings become unassigned policies, while updates to existing policies retain their assignments, so review both paths before applying.
Which CIS Windows 11 benchmark should I choose?
The admin problem is usually an existing tenant, with policies created at different times and settings that may already match CIS. Adding another large profile without checking those policies can leave you unsure which configuration owns a setting. Decide the target before adding anything.
Use the CIS Microsoft Intune for Windows 11 Benchmark for this workflow. Keep its profile, audit guidance and intended scope in your change record. Do not treat a Windows benchmark intended for another management method as a set of Settings Catalog instructions. Read each recommendation in context rather than copying a value without its impact.
How do I apply CIS Windows 11 settings with Intune?
In the Intune admin center, create a Windows Settings Catalog profile. Add the required settings, configure their values and review the profile before assigning it to your pilot group. Keep a record of each recommendation you mapped, including anything that requires a manual check.
Settings Catalog provides configuration and targeting. The work of matching your existing policies to the selected CIS recommendations still needs to be done. Microsoft security baselines are not a direct CIS mapping, so deploying one does not complete this comparison. Review conflicting values before extending assignments.
1. How do I assess existing Settings Catalog policies?
In TenuVault, select the tenant and open CIS Benchmarks. Load the Windows 11 Level you intend to use and check its certification label. For Windows 11, the documented certification applies to Level 1. CIS workflows require Pro or MSP; check the current plan table before starting.
Click Start assessment. The comparison reads Settings Catalog policies, their settings and assignments. Present means every occurrence matches the pack. Different means at least one occurrence has another value. Missing means no Settings Catalog policy configures it. Review means the pack contains alternative values requiring a profile choice.
2. How do I review and apply CIS remediation?
Select Different or Missing findings and choose Plan remediation for the selected findings. In Remediation history, inspect every policy to be created or updated, the settings and the assignment status. The preview compares against the assessment offline. It is not a live tenant dry run.
Approval reads the tenant again and stops the deployment if it has changed. Applying runs a backup first and captures the current state of changed policies. If that backup fails, nothing is written. After writing, TenuVault reads each change back to verify it. Inspect the results before deciding that the work is complete.
3. What happens to assignments after remediation?
Missing settings are created in new, unassigned policies. Assign them in Intune only after reviewing their intended pilot scope. Different settings are updated in place and retain assignments. Those updates can therefore reach devices already assigned to the policy; check that scope before approving the change.
Remediation is limited to settings in the delivered pack. Manual and Not covered recommendations need separate action. Not assessed recommendations can have only their included settings remediated. A successful write confirms configuration, rather than device enforcement. Check device results and business workflows, then run the assessment again.
If you need to undo the deployment, inspect its rollback preview. Rollback is another reviewed change set based on the captured previous state. It has limits, including masked values, and does not guarantee the previous device state. Keep the pilot small enough to investigate an unexpected result before expanding it.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Does remediation assign new policies automatically?+
No. Missing settings become unassigned policies. An administrator assigns them in Intune. Updated existing policies keep their assignments, which must be reviewed before applying.
Can every recommendation be applied automatically?+
No. TenuVault writes supported settings from the delivered pack to Settings Catalog. Manual work and device verification remain necessary; review each recommendation and its remediation indication.
Does applying remediation prove devices enforce CIS settings?+
No. Remediation changes Intune configuration and reads it back. Check assignment scope, device results and business workflows separately, then run the assessment again.