TenuVaultDesktopPractical guide
How to use CIS Benchmarks with Microsoft Intune
The Center for Internet Security publishes benchmarks written specifically for Microsoft Intune, including Microsoft Intune for Windows 11 and Windows 10, Edge, Microsoft Defender Antivirus and Office. The PDFs are free for non-commercial use. To use one, choose a profile level, map each recommendation to Intune settings, deploy them to a pilot group, record every deliberate exception and assess the result. Microsoft's own security baselines are not a substitute: Microsoft says they are not, strictly speaking, CIS compliant.
At a glance
- CIS publishes Intune-specific benchmarks, including Microsoft Intune for Windows 11 and for Windows 10, both at version 5.0.0 as of October 2026, plus Edge, Defender Antivirus and Office.
- CIS states that its benchmarks are freely available in PDF format for non-commercial use.
- CIS Build Kits and CIS-CAT Pro assessments are offered to CIS SecureSuite members.
- Microsoft says its Intune security baselines are, strictly speaking, not CIS or NIST compliant, because there is no one-to-one mapping.
- CIS comparisons are listed as coming soon in TenuVault and are not available on any plan yet.
What CIS publishes for Intune
CIS has benchmarks written for configuring Windows through Intune rather than Group Policy: Microsoft Intune for Windows 11 and Microsoft Intune for Windows 10, at version 5.0.0 when this guide was written, and benchmarks for Microsoft Edge, Microsoft Defender Antivirus and Office through Intune. Each recommendation describes the setting, the expected value, the rationale and how to audit it.
CIS says the benchmark PDFs are freely available for non-commercial use. CIS SecureSuite membership adds Build Kits, which contain JSON files you import into Intune configuration profiles, and CIS-CAT Pro, which scans devices against a benchmark. Check CIS's terms for your use before you copy benchmark content into your own documents or tools.
CIS is not the same as Microsoft's baselines
It is tempting to deploy Microsoft's Intune security baselines and call the result CIS. Microsoft answers that directly: asked whether its baselines are CIS or NIST compliant, it says strictly speaking no, because it consults organizations such as CIS but there is no one-to-one mapping. The community OpenIntuneBaseline also used the CIS Windows Benchmarks as one of several sources without applying them wholesale.
If an auditor or customer asks for CIS, you need to measure against the CIS benchmark itself.
Apply a CIS benchmark step by step
Treat a CIS benchmark like any other baseline: a reviewed starting point, rolled out carefully.
- Choose the profile level. CIS benchmarks define levels, with Level 1 as the broadly applicable base and higher levels for environments that accept more restriction.
- Compare the recommendations with what your tenant already configures, so you know which settings are new, which already match and which you set differently on purpose.
- Back up your Intune configuration, then create the missing settings as new, unassigned policies and assign them to a pilot group.
- Record every recommendation you do not follow, with the reason, an owner and a review date. Auditors expect documented exceptions, not perfect scores.
- Assess the result. A configuration comparison shows what your policies say; device assessment, for example with CIS-CAT Pro, shows what devices actually apply.
Where TenuVault fits today
CIS Benchmarks and CIS Controls are listed as coming soon in TenuVault and are not available on any plan yet. Until then, TenuVault helps around a CIS rollout: back up before you change anything, compare your configuration with NIST, ISO 27001, the Essential Eight and other frameworks, check for conflicts with existing policies, and track deliberate deviations with an owner and reason on Pro and MSP.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Is there a CIS Benchmark for Microsoft Intune?+
Yes. CIS publishes benchmarks written for Intune, including Microsoft Intune for Windows 11 and for Windows 10, plus Edge, Microsoft Defender Antivirus and Office. The PDFs are free for non-commercial use.
Are Microsoft's Intune security baselines CIS compliant?+
Strictly speaking, no. Microsoft says it consults organizations such as CIS, but there is no one-to-one mapping between its baselines and CIS.
How do I import CIS settings into Intune?+
CIS SecureSuite members get Build Kits with JSON files that are imported into Intune configuration profiles. Without membership, configure each recommendation from the benchmark PDF in Settings Catalog policies by hand, then pilot them.
Does TenuVault support CIS Benchmarks?+
Not yet. CIS Benchmarks and CIS Controls are listed as coming soon in TenuVault and are not available on any plan today. Other framework comparisons, such as NIST and ISO 27001, are available now.