Security baselines¶
Security baselines are preconfigured groups of settings that reflect Microsoft's security recommendations. They're the fastest way to get a strong starting configuration, and the fastest way to break an app if you deploy them blindly.
Find them under Endpoint security > Security baselines.
Available baselines¶
| Baseline | Covers | Notes |
|---|---|---|
| Security Baseline for Windows 10 and later | Windows hardening: credential protection, SMB, Defender, BitLocker, firewall, attack surface reduction and more | New versions follow Windows releases, such as 24H2, 25H2 and 26H2 |
| Microsoft Defender for Endpoint | Defender antivirus, attack surface reduction, network protection, firewall | Optimized for physical devices. Not recommended for VMs or VDI. |
| Microsoft 365 Apps for enterprise | Office macro, add-in and file block settings | Test with heavy Excel and Access users |
| Microsoft Edge | Browser security settings | |
| Windows 365 | Cloud PC hardening | For Windows 365 Cloud PCs |
Organizations with Advanced Analytics also get a STIG audit baseline, which reports how Windows devices measure up against Department of Defense STIG requirements without changing anything.
How to deploy a baseline safely¶
- Create the profile from the newest version and keep the defaults at first.
- Assign it to a test ring of real devices, not just virtual machines.
- Review the results in the profile's per-setting status, and listen to your pilot users for broken apps, printers, drives and remote access.
- Document each deviation. When you change a default, write down why in the profile description or your change record. Future you will want to know.
- Widen in rings. See Change management.
Settings that commonly cause trouble¶
Baseline defaults are secure by design, which sometimes means stricter than your environment can take on day one. Check these before broad rollout:
| Setting (Windows baseline) | Default | Watch out for |
|---|---|---|
| Configure LSA Protected Process | Enabled with UEFI lock | Third-party credential providers and some security tools. The UEFI lock means turning it off later needs local action on the device. |
| Disable Local Admin Merge (Defender) | Enabled | Locally configured Defender exclusions are ignored. Apps that rely on local exclusions need them added to Intune policy instead. |
| Enable Convert Warn To Block (Defender) | Enabled | Warn verdicts become blocks, which users notice |
| Attack surface reduction rules | Mix of block and audit | Office macros, PsExec and WMI-based admin tools, older line-of-business apps |
| Cloud Block Level (Defender) | High | More aggressive blocking of unknown files |
| Allow Direct Memory Access | Block | Some Thunderbolt docks and peripherals while the device is locked |
| Legacy Edge (Browser CSP) settings such as Allow Password Manager: Block | Block | These apply to the legacy browser CSP. Manage the current Microsoft Edge with the Edge baseline or Edge settings in the settings catalog. |
One owner per setting¶
The most common baseline problem isn't a bad setting, it's a conflict. The Windows baseline, the Defender baseline, endpoint security policies and settings catalog profiles can all configure the same settings, and two different values means the setting doesn't apply.
Pick a model and stick to it:
| Model | How it works | Suits |
|---|---|---|
| Baseline first | Deploy the Windows baseline as the foundation. Use endpoint security policies only for settings the baseline doesn't cover, and change baseline values in the baseline itself. | Teams that want Microsoft's defaults with few changes |
| Policies first | Don't deploy the baselines. Build focused settings catalog and endpoint security policies using the baseline as a reference. | Mature teams that want full control and clearer ownership |
Either way, don't deploy the Windows baseline and the Defender baseline and endpoint security antivirus policies with different values. Use the device's configuration page to spot conflicts after each change.
Upgrading to a new baseline version¶
Microsoft publishes new baseline versions as Windows changes. Profiles created from an older version keep working, but they don't get new recommendations.
- Open the baseline and use compare baselines to export the differences between your current version and the new one.
- Create a new profile from the new version (or update the existing profile's version), carrying over your documented deviations.
- Pilot it like any other change, then retire the old profile. Don't leave both assigned: that's a guaranteed conflict.
Beyond Microsoft's baselines¶
Many organizations also measure against external benchmarks such as the CIS Microsoft Intune benchmarks. These are stricter in places and organized differently. Use them as a checklist against your configuration rather than deploying two overlapping sets of settings.