# Recheck CIS compliance in Intune after a change | TenuVault Recheck CIS compliance in Intune after a policy change: use alerts to trigger a fresh assessment, review changed settings and retain follow-up evidence. Canonical: https://www.tenuvault.com/guides/recheck-cis-compliance-in-intune Practical guide # Recheck CIS compliance in Intune Recheck CIS compliance in Intune by running a fresh assessment after an approved configuration change. TenuVault change alerts can prompt that review, but an alert does not rerun the CIS assessment or prove a device has applied the setting. [Start free Pro trial](https://www.tenuvault.com/trial?src=feature)[Plans and features](https://www.tenuvault.com/pricing) ## What should trigger a CIS recheck? A security setting can change after the last assessment, leaving yesterday's evidence out of date. Define a review trigger for updates, deletions and assignment changes to policies in the benchmark scope. Keep the change ticket, affected policies and previous assessment together so the reviewer knows what needs checking. This guide covers the follow-up loop after a change. Choose the benchmark and Level using the CIS Level selection guide before starting. Preserve the benchmark version and Level for the next run; comparing different packs can confuse a changed assessment basis with a changed tenant. - [Start with CIS Benchmarks and Intune](https://www.tenuvault.com/guides/cis-benchmarks-with-intune) - [Choose CIS Level 1 or Level 2 for Intune](https://www.tenuvault.com/guides/cis-level-1-vs-level-2) ## What can I check in Intune first? Review the changed policy, its settings and assignments in the Intune admin center. Then inspect device configuration reporting for the affected population. Resolve reporting errors and unexpected targeting before concluding that an intended security change has reached devices. That native check answers a deployment question. Reassessment answers a separate question: how the current Settings Catalog configuration compares with the selected benchmark pack. Keep both records, especially when a newly matching configuration is still waiting for device check-in. - [Microsoft Intune configuration reports](https://learn.microsoft.com/en-us/intune/intune-service/fundamentals/reports) ## How do I recheck CIS compliance in Intune? 1\. Select the tenant and open CIS Benchmarks. Record the earlier assessment, benchmark version and Level. If you open a saved assessment, confirm its pack before using Run again, since that action makes its pack the loaded pack. 2\. Select Start assessment or Run again. The assessment reads Settings Catalog policies, settings and assignments and is read-only. A previous saved result is not a live view of the tenant. 3\. Review changed recommendations and inspect policy and assignment evidence. Keep manual, not assessed and not covered work visible. A successful automated setting check does not settle recommendations outside that coverage. 4\. Attach the new assessment to the change ticket and verify the affected devices in Intune. If unexpected differences remain, decide whether to correct the intended change or investigate another policy before closing the ticket. - [CIS assessment and saved assessment behavior](https://docs.tenuvault.com/baselines/cis-benchmarks/) - [Prepare a CIS compliance report from Intune evidence](https://www.tenuvault.com/guides/cis-compliance-report-intune) ## How do change alerts prompt another assessment? On Pro or MSP, open Alerts for the tenant and configure the destination and change events you need. Send a test message and confirm someone owns the follow-up. Use change watching to notify the team about relevant Intune activity, then run the CIS assessment explicitly. Write the operational response into the alert procedure: identify the change, review approval, run the same benchmark pack and Level, inspect differences and check device reporting. Do not describe a general policy change alert as a CIS failure alert. It reports activity that may need review, not the result of a fresh benchmark assessment. Route planned work and unexpected changes through the same follow-up queue so neither is forgotten after the alert is acknowledged. Name the person who checks the assessment result and the person who verifies device delivery. Confirm CIS assessment access on Pro or MSP before relying on this procedure. - [Set up Intune change alerts](https://www.tenuvault.com/intune-alerts) - [Documented alert setup](https://docs.tenuvault.com/notifications/) ## How can I try the follow-up loop on my tenant? Download TenuVault and practice one approved CIS change with a known benchmark pack and Level. Confirm the alert reaches its owner, rerun the assessment and check the affected devices before closing the change. - [Download TenuVault](https://www.tenuvault.com/download) - [Plans and features](https://www.tenuvault.com/pricing) - [Investigate who changed an Intune policy](https://www.tenuvault.com/guides/who-changed-intune-policy) - [Framework comparison overview](https://www.tenuvault.com/guides/compare-intune-with-security-frameworks) - [Apply CIS Windows 11 settings in Intune](https://www.tenuvault.com/guides/apply-cis-windows-11-intune) ## Read the technical guides - [CIS Benchmarks workflow](https://docs.tenuvault.com/baselines/cis-benchmarks/) Product scope reviewed 11 November 2026. Check your installed release and the current plan table before using a workflow. ## Frequently asked questions ### Q: Does a change alert rerun the CIS assessment? A: No. Use the alert as a review trigger, then explicitly run the assessment against the selected benchmark pack. ### Q: Can I just export the previous assessment again? A: An export uses the saved assessment and does not reread the tenant. Run again after a change before presenting the result as current evidence. ### Q: Does a matching setting prove device enforcement? A: No. Verify the affected devices with Intune reporting and investigate pending or failed deployment separately. ## Related guides - [validate your Intune baseline](https://www.tenuvault.com/openintunebaseline) - [SOC 2 Intune evidence](https://www.tenuvault.com/guides/soc-2-intune-evidence) - [How to update OpenIntuneBaseline without losing your changes](https://www.tenuvault.com/guides/update-openintunebaseline) - [Checking CIS Benchmarks in a spreadsheet or automatically](https://www.tenuvault.com/compare/cis-benchmark-spreadsheet-vs-automated-assessment) ## Review your setup before the first change Community is free for one tenant. Try Pro free by connecting a new tenant in the app, no email or card needed. Tenant access, supported restore types and scheduling requirements still apply. [Start free trial](https://www.tenuvault.com/trial?src=cta)[Book a 30-minute demo](https://cal.com/ugur-koc/tenuvault-demo)[Permissions and data flows](https://www.tenuvault.com/trust)