TenuVaultDesktopPractical guide
OpenIntuneBaseline vs Microsoft security baselines
Microsoft's Intune security baselines are templates built into the admin center, mostly for Windows and Microsoft products, that you deploy as baseline profiles. OpenIntuneBaseline is an independent community baseline delivered as ordinary Intune policies for Windows, macOS, Windows 365 and BYOD, informed by several frameworks. Neither is a compliance certification. Many tenants use one as the foundation and borrow from the other, which works as long as you check for settings both configure.
At a glance
- Microsoft security baselines are templates in the Intune admin center, under Endpoint security, Security baselines.
- Microsoft says its Intune security baselines are, strictly speaking, not CIS or NIST compliant.
- OpenIntuneBaseline is maintained by SkipToTheEndpoint and contributors under GPL-3.0 and ships as Intune policies per platform.
- OpenIntuneBaseline's author analyzed NCSC, CIS, ACSC Essential Eight, Microsoft's baselines and Microsoft best practice, without simply applying any one of them.
- When Microsoft publishes a new baseline version, settings in profiles based on older versions become read-only until you update the profile.
Side by side
The table summarizes the differences that matter when you choose.
| Microsoft security baselines | OpenIntuneBaseline | |
|---|---|---|
| Who maintains it | Microsoft, with the Windows security team | SkipToTheEndpoint and community contributors |
| Platforms | Windows, plus Defender for Endpoint, Edge, Microsoft 365 Apps, Windows 365 and HoloLens 2 | Windows, macOS, Windows 365 and BYOD app protection, with more platforms in development |
| Format | Baseline profiles built from a Microsoft template | Ordinary Intune policies, mostly Settings Catalog, imported from JSON |
| Sources | Microsoft's own security recommendations | NCSC, CIS Windows Benchmarks, ACSC Essential Eight, Microsoft baselines and best practice |
| Updates | New template versions; older profiles become read-only until updated | Versioned releases per platform, for example windows-v4.0, with a changelog |
| License and cost | Included with Intune | Free, GPL-3.0 |
When each one fits
Microsoft's baselines fit when you want a template that lives inside Intune, with Microsoft's own version updates and reporting per baseline profile, and when your estate is mostly Windows.
OpenIntuneBaseline fits when you want a broader starting point across Windows, macOS and Windows 365, delivered as normal policies you can read, edit and assign like any other, and when you value the reasoning documented in its project.
Using both is common, but they overlap. Microsoft notes that security baselines often manage the same settings as device configuration profiles, and two policies setting the same value differently create a conflict on the device. Decide which one owns each area, and check for conflicts before you assign both to the same devices.
Check either baseline against your tenant
TenuVault works with both. The OpenIntuneBaseline section deploys, compares and validates OIB policies setting by setting. For Microsoft's baselines, you import your reviewed baseline policy exports as a Microsoft Security Baselines pack under Frameworks and compare your Settings Catalog policies with it. Both are included in the free Community plan.
Read the technical guides
Product scope reviewed . Check your installed release and the current plan table before using a workflow.
Frequently asked questions
Is OpenIntuneBaseline made by Microsoft?+
No. OpenIntuneBaseline is an independent community project maintained by SkipToTheEndpoint and contributors under GPL-3.0. It draws on Microsoft's baselines among other sources, but Microsoft does not publish or support it.
Can I use OpenIntuneBaseline and Microsoft security baselines together?+
Yes, but check for overlap. Both configure many of the same Windows settings, and two policies that set the same setting to different values cause a conflict on the device. Decide which baseline owns each area before you assign both.
Is either baseline CIS compliant?+
Neither claims to be. Microsoft says its baselines are, strictly speaking, not CIS or NIST compliant. OpenIntuneBaseline used the CIS Windows Benchmarks as one of several sources but was not created by applying any single framework.
Which baseline covers macOS?+
OpenIntuneBaseline has a macOS baseline. Microsoft's Intune security baselines focus on Windows and Microsoft products such as Defender, Edge and Microsoft 365 Apps.