CIS Level 1 vs Level 2 for Intune: which should I use?

How do I choose CIS Level 1 vs Level 2?

An admin needs a baseline that survives normal work: signing in, using business applications and supporting remote devices. Agree the target with security and service owners before changing policy. Record which devices are in scope, what requirement drives the choice and who can accept an exception.

CIS describes Level 1 as a base profile intended to preserve usability. Level 2 adds defense in depth for environments where security takes priority and needs particular care during implementation. Test either profile first. A Level 1 label does not remove the need to check application compatibility.

• CIS profile definitions

Can Intune security baselines meet CIS requirements?

Intune Settings Catalog lets you configure settings in a policy and assign that policy to a group. You can work through the selected CIS profile, record the expected values and test the resulting policies with a pilot group. Keep the benchmark and profile attached to your change record.

Microsoft security baselines offer another starting point for Windows configuration. They are not a declaration of CIS compliance: Microsoft says there is no one-to-one mapping. Neither choosing a Microsoft baseline nor naming a policy Level 2 establishes that you meet the corresponding CIS recommendations.

• Microsoft security baseline scope

1. How do I load a CIS benchmark Level in TenuVault?

Select your tenant and open CIS Benchmarks. Under Load benchmark, inspect the available packs and their Levels. Choose the Level you intend to assess. Loading a pack does not change tenant configuration. CIS assessment, remediation and reports require Pro or MSP, as listed on the pricing page.

Keep availability and certification separate. The documented certified Windows 11 scope is Level 1. Do not assume Windows 11 Level 2 is delivered or certified because another benchmark offers both Levels. Read the CIS Certified or Not certified label beside the selected Level before describing its scope to anyone.

• Plans and features
• How CIS Benchmarks fit with Intune

2. How do I read CIS readiness and coverage?

Click Start assessment. The read-only comparison checks Settings Catalog configuration against the loaded pack. Review readiness per Level and the coverage statement together. A high pass rate is less useful without knowing which recommendations were checked and which need separate evidence.

Read Manual, Not assessed and Not covered recommendations before deciding the work is small. Review alternative values against the profile you selected. Where you accept a deviation, Exclude from score records an owner, reason and expiry date. Keep the raw rate alongside the rate with exclusions so the exception remains visible.

3. When should I expand beyond the pilot?

For Level 1, agree which gaps must close before a wider assignment and which exceptions need approval. If Level 2 is required, review its additional restrictions separately with the teams whose work they affect. Keep a test checklist for business applications, remote support and recovery access.

Use configuration readiness as one input to that decision. It does not establish that the right devices received or enforced a setting. Confirm assignment and device results separately, document manual checks and set a review date. Reassess after the approved changes so the decision rests on current configuration.

• Choose Windows settings for a maintained baseline
• Back up Intune policies before changing a baseline