Windows overview
The baseline has been designed for, and tested on the following.
Intended use-case
Section titled “Intended use-case”Device
Section titled “Device”- Windows 11 Enterprise (though it should also work on Windows 10 Enterprise)
- Enrolled into Autopilot
- Autopilot configuration:
- Deployment mode: User Driven
- Join type: Microsoft Entra Joined
- User account type: Standard
- Single-user device
- Cloud-only or hybrid identity with Entra ID as IdP
- MFA configured via Conditional Access
Licensing
Section titled “Licensing”Either:
- M365 Business Premium, M365 E5/A5, or M365 E3/A3 + MDE P1/P2
or:
- Entra ID P1 or P2
- Office 365 E3/E5, A3/A5 or F3
- Intune P1
- Defender for Business or Endpoint P1/P2
Hybrid join
Section titled “Hybrid join”The Windows OIB has not been designed for hybrid scenarios, and will likely not work as expected or intended on hybrid-joined devices.
It is Microsoft’s recommendation that you move to cloud-native for new devices.
I would personally recommend maintaining GPO for on-prem devices, and using Intune for cloud-native devices, with the exception of things like Endpoint Analytics, Windows Update for Business and Application Deployment. Applying Intune policy over the top of GPO can cause unexpected results, and should be avoided where possible. Similarly, GPOs may well leave registry keys behind that can cause unexpected results when applying Intune policy.
Successful application of the baseline outside of this configuration cannot be guaranteed.