Practical guide

Best Intune settings for Windows devices: where to start

There is no single best set of Intune settings, and both Microsoft and the main community baseline say so. The practical answer is to start from a maintained baseline, either Microsoft's Intune security baselines or the community OpenIntuneBaseline, check it against your licensing, deploy it to a pilot group first, record every deliberate exception and keep it current when new versions appear. TenuVault deploys OpenIntuneBaseline unassigned, with a backup first, on its free Community plan.

Start with Community Plans and features

At a glance

Microsoft says the default settings in its security baselines are in almost all cases the most restrictive, and that you should confirm they do not conflict with your other policies.
OpenIntuneBaseline describes itself as a starting point that is not necessarily complete, and says a true one-size-fits-all set of policies is impossible.
OpenIntuneBaseline is maintained by SkipToTheEndpoint and contributors under GPL-3.0 and covers Windows, macOS, Windows 365 and BYOD app protection.
Some baseline policies depend on licensing, such as Microsoft 365 Business Premium or E3 and E5, Defender for Endpoint or Windows Autopatch.
TenuVault Community deploys new OpenIntuneBaseline policies unassigned, runs a backup first once storage is configured and can undo each deployment run.

Why there is no single best configuration

The right settings depend on your devices, licensing, users and risk appetite. A setting that is right for a locked-down finance laptop can break a developer workstation or a shared kiosk. That is why both Microsoft and the community baseline present their work as a starting point you adjust, not a final answer.

Microsoft writes that the default settings in its security baselines are in almost all cases the most restrictive, and that you should confirm they do not conflict with other policies or features. OpenIntuneBaseline writes that it is impossible to create a true one-size-fits-all set of policies and that every configuration, whatever its source, should be reviewed and adjusted.

Two maintained starting points

Microsoft's Intune security baselines are built into the admin center: the Security Baseline for Windows 10 and later, plus baselines for Microsoft Defender for Endpoint, Microsoft Edge, Microsoft 365 Apps and Windows 365. You create a baseline profile, customize it and assign it.

OpenIntuneBaseline is an independent community project. Its author analyzed the NCSC Device Security Guidance, the CIS Windows Benchmarks, the ACSC Essential Eight, Microsoft's Intune security baselines and Microsoft best practice, and states that it was not created by simply applying those recommendations. It ships as a set of ordinary Intune policies per platform, versioned as releases.

You can use one, the other or both, as long as you check for overlapping settings. The comparison guide covers the differences in detail.

OpenIntuneBaseline vs Microsoft security baselines

A safe way to roll out a baseline

Whichever baseline you choose, roll it out the same careful way.

Take a backup of your Intune configuration first, so you can put back anything the baseline replaces.
Check licensing. Policies for Defender for Endpoint, Windows Autopatch or features of Microsoft 365 E3 and E5 do not fit every tenant.
Create the policies unassigned and read them before they reach a device.
Assign them to a small pilot group, watch device status and conflict reports for a few days, then widen the rollout in rings.
Write down every setting you change from the baseline, with the reason and an owner, so the next update does not undo a deliberate decision.
Plan for updates. Baselines change as Windows and threats change, so review new versions instead of deploying once and forgetting.

Deploy OpenIntuneBaseline with TenuVault

TenuVault's New Deployment asks for the tenant's licensing (Microsoft 365 Business Premium, or E3, E5 or E7), whether Defender for Endpoint is the primary antivirus and whether Windows updates are managed by Autopatch, and filters out policies that do not fit. Policies already in the tenant are left out.

New policies are created unassigned by default, or for a reviewed pilot group. A backup runs first once storage is configured, and if it fails the deployment does not proceed. Each run can be undone. All of this is included in the free Community plan.

After the rollout, Policy Validation checks the deployed policies setting by setting against the baseline, and framework comparisons show how the result maps to NIST, ISO 27001, the Essential Eight and other frameworks.

Read the technical guides

Product scope reviewed 31 October 2026. Check your installed release and the current plan table before using a workflow.

Frequently asked questions

What are the best Intune settings for Windows 11?

There is no single best set. Start from a maintained baseline such as Microsoft's Intune security baselines or OpenIntuneBaseline, adjust it to your licensing and users, pilot it on a small group and record every exception. Both Microsoft and OpenIntuneBaseline describe their baselines as a starting point to review.

Should I use Microsoft security baselines or OpenIntuneBaseline?

Either is a reasonable start. Microsoft's baselines are built into Intune and cover Windows, Defender, Edge, Microsoft 365 Apps and Windows 365. OpenIntuneBaseline is a community project delivered as ordinary Intune policies for Windows, macOS, Windows 365 and BYOD. If you use both, check for settings they both configure.

Can I deploy a baseline without affecting devices?

Yes. Create the policies unassigned, review them, then assign them to a pilot group. TenuVault creates new OpenIntuneBaseline policies unassigned by default and can undo a deployment run.

Is OpenIntuneBaseline free?

Yes. OpenIntuneBaseline is an open community project licensed under GPL-3.0. TenuVault Community, which deploys, compares and validates it, is also free for one tenant.