How to compare Intune configuration with security frameworks

What Intune's own security baselines cover

Intune security baselines are groups of preconfigured Windows settings that you deploy as profiles, for example the Security Baseline for Windows 10 and later, the Microsoft Defender for Endpoint baseline or the Microsoft Edge baseline. Their reports show how devices respond to the baseline profiles you deployed.

They do not compare the rest of your configuration with a framework. Microsoft answers the question directly: asked whether the baselines are CIS or NIST compliant, it says strictly speaking no, because there is no one-to-one mapping. Baselines also often manage the same settings as your other profiles, so deploying one can create conflicts that you have to investigate.

• Microsoft Learn: Intune security baselines
• Microsoft Learn: monitor security baselines

How a framework comparison works

A framework describes controls, such as requiring disk encryption or restricting macros. A comparison needs a technical mapping from each control to the Intune settings that implement it, and then reads your policies to see whether those settings are configured with the expected values and assigned.

A useful comparison also says what it could not evaluate. Some controls have no configuration check at all, and some depend on group membership, filters or device state that a policy read cannot see. Read the coverage alongside the score, because a high score on low coverage proves little.

Compare your tenant with TenuVault

Open Frameworks in the TenuVault sidebar to see the catalog. There are two kinds of comparison, and both run on the admin's computer against the tenant you are signed in to.

• Built-in comparisons check your tenant against technical mappings for NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 3 and Rev. 2, ASD Essential Eight with a target maturity level, Cyber Essentials, ISO/IEC 27001:2022, SOC 2, BSI IT-Grundschutz and UK MOD Def Stan 05-138. They are read-only.
• Policy-pack comparisons check your Settings Catalog policies setting by setting against the UK NCSC Device Security Guidance Windows pack, or a pack you import for Microsoft Security Baselines, DISA STIG or a custom baseline. Except for the NCSC pack, they can create the missing settings as new, unassigned policies.
• OpenIntuneBaseline has its own section, which deploys, compares and validates the community baseline policies.
• Every comparison can be exported as a PDF report, CSV or JSON, built on your device from the saved result. Secrets are redacted and nothing is uploaded.
• On Pro and MSP, Governance turns saved comparisons into a baseline score per framework, with its coverage and the top gaps.

• Framework coverage
• OpenIntuneBaseline
• Baseline scores

What a comparison does not prove

A framework comparison shows whether your Intune configuration matches a technical mapping. It does not prove that devices enforce the settings, that every user is in scope, or that you comply with the full framework, which also covers people, processes and systems outside Intune. Treat the results as evidence for an auditor to review, not as a certification, and record deliberate differences with their reason and owner.