Windows included settings
Included settings
Section titled “Included settings”- Core device security hardening
- Device encryption via BitLocker
- Google Chrome (note: policies are quite “anti-Chrome” to encourage the use of Edge)
- Microsoft Edge (split into multiple policies for easier management)
- Microsoft Office (including OneDrive Known Folder Move)
- Microsoft Defender for Endpoint (AV, Firewall, ASR Rules)
- Windows LAPS
- Windows Update for Business (Delivery Optimisation, Telemetry and WUfB Reports)
- Windows Update Rings (3-ring model of Pilot, UAT and Production)
- Windows Hello for Business
Almost all policies are Settings Catalog-backed and will show in Devices > Configuration profiles. The following appear in the Endpoint security section of Intune instead:
- Defender Antivirus
- BitLocker Encryption
- Windows Firewall
- Windows Hello for Business
- Windows LAPS
For a complete list of settings, see the settings reference, which includes a searchable view of the baseline on intunesettings.app, and SETTINGSOUTPUT.md in the repo. The full policy changelog is in CHANGELOG.md.
Known limitations
Section titled “Known limitations”Due to the wildly differing nature of environments, it is not possible to create a “baseline” for AppLocker or Windows Defender Application Control (WDAC). While the baseline ensures standard users cannot elevate to install applications, apps that do not require elevation or install to a user’s AppData folder may not be blocked.
Supporting configuration
Section titled “Supporting configuration”- Windows Autopatch - If your licensing supports it, I would strongly recommend implementing Autopatch for management of your Windows quality, driver and feature updates. See the Autopatch overview.
- Windows Update for Business Reports - With an appropriate Azure subscription, a Log Analytics workspace can be created to monitor update compliance of devices. See the WUfB reports overview.
- M365 Apps updates - Enabling Cloud Update through config.office.com can ensure Office apps for Business/Enterprise remain up-to-date on the Monthly Enterprise Channel. Settings in the “Office - Update Settings” policy can remain as Cloud Update takes priority over any other Office management. Ensure the Inventory is enabled.