# Apply CIS Windows 11 in Intune Settings Catalog | TenuVault Apply CIS Windows 11 settings through Intune Settings Catalog. Assess first, review remediation, check assignments and test a pilot before deployment. Canonical: https://www.tenuvault.com/guides/apply-cis-windows-11-intune Practical guide # Apply CIS Windows 11 Benchmark with Intune Settings Catalog Apply CIS Windows 11 Benchmark by choosing the Intune-specific benchmark and profile, comparing its recommendations with existing policy, then deploying reviewed settings to a pilot. In TenuVault, begin with a read-only assessment and plan remediation from its findings. Missing settings become unassigned policies, while updates to existing policies retain their assignments, so review both paths before applying. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing) ## Which CIS Windows 11 benchmark should I choose? The admin problem is usually an existing tenant, with policies created at different times and settings that may already match CIS. Adding another large profile without checking those policies can leave you unsure which configuration owns a setting. Decide the target before adding anything. Use the CIS Microsoft Intune for Windows 11 Benchmark for this workflow. Keep its profile, audit guidance and intended scope in your change record. Do not treat a Windows benchmark intended for another management method as a set of Settings Catalog instructions. Read each recommendation in context rather than copying a value without its impact. - [CIS benchmarks for Intune](https://www.cisecurity.org/benchmark/intune) - [Choose Windows settings for a maintained baseline](https://www.tenuvault.com/guides/best-intune-settings-windows) ## How do I apply CIS Windows 11 settings with Intune? In the Intune admin center, create a Windows Settings Catalog profile. Add the required settings, configure their values and review the profile before assigning it to your pilot group. Keep a record of each recommendation you mapped, including anything that requires a manual check. Settings Catalog provides configuration and targeting. The work of matching your existing policies to the selected CIS recommendations still needs to be done. Microsoft security baselines are not a direct CIS mapping, so deploying one does not complete this comparison. Review conflicting values before extending assignments. - [Microsoft Settings Catalog instructions](https://learn.microsoft.com/en-us/intune/device-configuration/settings-catalog/) - [CIS and Intune overview](https://www.tenuvault.com/guides/cis-benchmarks-with-intune) ## 1\. How do I assess existing Settings Catalog policies? In TenuVault, select the tenant and open CIS Benchmarks. Load the Windows 11 Level you intend to use and check its certification label. For Windows 11, the documented certification applies to Level 1. CIS workflows require Pro or MSP; check the current plan table before starting. Click Start assessment. The comparison reads Settings Catalog policies, their settings and assignments. Present means every occurrence matches the pack. Different means at least one occurrence has another value. Missing means no Settings Catalog policy configures it. Review means the pack contains alternative values requiring a profile choice. - [Current plans](https://www.tenuvault.com/pricing) ## 2\. How do I review and apply CIS remediation? Select Different or Missing findings and choose Plan remediation for the selected findings. In Remediation history, inspect every policy to be created or updated, the settings and the assignment status. The preview compares against the assessment offline. It is not a live tenant dry run. Approval reads the tenant again and stops the deployment if it has changed. Applying runs a backup first and captures the current state of changed policies. If that backup fails, nothing is written. After writing, TenuVault reads each change back to verify it. Inspect the results before deciding that the work is complete. - [Back up Intune policies before remediation](https://www.tenuvault.com/intune-backup) - [Find conflicting Intune settings before rollout](https://www.tenuvault.com/guides/find-conflicting-intune-settings) ## 3\. What happens to assignments after remediation? Missing settings are created in new, unassigned policies. Assign them in Intune only after reviewing their intended pilot scope. Different settings are updated in place and retain assignments. Those updates can therefore reach devices already assigned to the policy; check that scope before approving the change. Remediation is limited to settings in the delivered pack. Manual and Not covered recommendations need separate action. Not assessed recommendations can have only their included settings remediated. A successful write confirms configuration, rather than device enforcement. Check device results and business workflows, then run the assessment again. If you need to undo the deployment, inspect its rollback preview. Rollback is another reviewed change set based on the captured previous state. It has limits, including masked values, and does not guarantee the previous device state. Keep the pilot small enough to investigate an unexpected result before expanding it. ## Read the technical guides - [CIS Benchmarks workflow and limits](https://docs.tenuvault.com/baselines/cis-benchmarks/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Does remediation assign new policies automatically? A: No. Missing settings become unassigned policies. An administrator assigns them in Intune. Updated existing policies keep their assignments, which must be reviewed before applying. ### Q: Can every recommendation be applied automatically? A: No. TenuVault writes supported settings from the delivered pack to Settings Catalog. Manual work and device verification remain necessary; review each recommendation and its remediation indication. ### Q: Does applying remediation prove devices enforce CIS settings? A: No. Remediation changes Intune configuration and reads it back. Check assignment scope, device results and business workflows separately, then run the assessment again. ## Related guides - [validate your Intune baseline](https://www.tenuvault.com/openintunebaseline) - [Best Intune settings for Windows devices: where to start](https://www.tenuvault.com/guides/best-intune-settings-windows) - [How to use CIS Benchmarks with Microsoft Intune](https://www.tenuvault.com/guides/cis-benchmarks-with-intune) - [Create a CIS compliance report for Intune (PDF or CSV for auditors)](https://www.tenuvault.com/guides/cis-compliance-report-intune) ## Try it on your tenant Try a Windows 11 assessment in TenuVault with the Level offered to your tenant, then inspect one recommendation before considering remediation. Confirm the plan and certified scope for that selection. [Start with Community](https://www.tenuvault.com/download)[Plans and features](https://www.tenuvault.com/pricing)