If your business supplies the US Department of Defense, directly or as a subcontractor, CMMC is now part of winning and keeping contracts. Much of what an assessor wants to see on laptops and phones is something Microsoft Intune already does. This article explains where Intune CMMC work fits, which controls it covers, the cloud decisions you need to make first, and how to produce evidence an assessor will accept.
CMMC in two minutes
The Cybersecurity Maturity Model Certification is the DoD’s standard for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the Defense Industrial Base. Under CMMC 2.0 there are three levels:
Level 1, Foundational: basic cyber hygiene for contractors handling FCI.
Level 2, Advanced: aligned with the practices in NIST SP 800-171, for contractors handling CUI.
Level 3, Expert: Level 2 plus practices from NIST SP 800-172 for the most sensitive programs.
Depending on the contract, you either self-assess or need a third-party assessment by an accredited C3PAO. Microsoft is clear that CMMC applies to the contractor’s practices, not to the cloud service itself. Using Microsoft 365 and Intune does not make you compliant. It gives you the tools to implement and evidence the controls.
Decide your cloud before you configure anything
The first question is not about Intune settings. It is where your CUI lives.
Microsoft’s own CMMC guidance states that the commercial and GCC clouds are not suitable to hold CUI Specified data, such as ITAR or export-controlled information, which needs the US sovereignty that Microsoft 365 GCC High provides. Intune is available in GCC High, but some features arrive later or work differently than in the commercial cloud, so check feature availability before you design around something.
The other decision is scope. Microsoft describes two approaches:
Enclave: a separate, tightly controlled environment just for the people and devices that handle CUI. Smaller, cheaper, faster to stand up.
All in: the whole organization moves into the compliant environment. More cost and effort, but Microsoft notes that the most common spillage happens through personal storage and email outside the boundary, which an enclave does not prevent.
For a 20 to 200 person manufacturer where most staff touch drawings or specifications, “all in” is often simpler to run than it first appears. For a services firm where three engineers handle CUI, an enclave can make sense. Either way, every device that can reach CUI is in scope, and that is where Intune comes in.
Where Intune covers NIST SP 800-171 requirements
CMMC Level 2 follows the NIST SP 800-171 requirement families. Intune, working with Microsoft Entra ID and Microsoft Defender for Endpoint, supports a large share of the endpoint-related ones.
Requirement family
How Intune and related tools help
Access Control
Conditional Access requiring compliant devices; blocking personal device enrollment; app protection policies controlling copy, paste and save on mobile; session timeouts.
Configuration Management
Security baselines and settings catalog policies enforce a documented configuration; app deployment and software inventory show what is installed; standard user accounts by default.
Identification and Authentication
Windows Hello for Business, MFA through Entra ID, Windows LAPS for unique local admin passwords.
Media Protection
Defender device control to block or restrict USB storage; BitLocker To Go required for removable drives.
System and Communications Protection
BitLocker disk encryption with keys escrowed to Entra ID; Windows Firewall policy; VPN and Wi-Fi profiles with certificates.
System and Information Integrity
Microsoft Defender Antivirus policy, Windows Update rings or Windows Autopatch, vulnerability findings from Defender.
Audit and Accountability
Intune audit logs for admin actions, device event data in Defender, export to Microsoft Sentinel for retention.
Intune does not cover everything. Physical protection, personnel security, awareness training and much of risk assessment are process and people controls. Purview handles CUI labelling and data loss prevention. The System Security Plan (SSP) ties it together.
A practical Intune build for a CUI boundary
Define in-scope groups. Create Entra security groups for CUI users and CUI devices, and target all policies at them.
Block personal enrollment. Use device platform restrictions so only corporate devices enrolled through Windows Autopilot, Apple Automated Device Enrollment or Android Enterprise corporate modes can join.
Apply a security baseline. Start from the Microsoft security baseline for Windows in Intune, then document every deviation and the reason.
Enforce encryption. BitLocker on all Windows devices with recovery keys in Entra ID; FileVault on Macs. NIST SP 800-171 expects FIPS-validated cryptography for protecting CUI, so confirm the validation status of the encryption you rely on and record it in the SSP.
Control removable media. Device control blocking write access to USB except approved, encrypted drives.
Require compliance for access. Compliance policies for OS version, encryption, Defender status and firewall, enforced through Conditional Access on every app that can reach CUI.
Protect admin actions. Least-privilege Intune roles, Privileged Identity Management, and Multi Admin Approval for wipes and scripts.
Collect logs. Send Intune and Defender data to a log workspace with retention that meets your SSP.
Evidence: what assessors actually ask for
A policy that exists in Intune is not evidence until you can show it applies to every in-scope device. Build an evidence pack as you go, not the week before the assessment.
Exported policy settings for each baseline, compliance and configuration profile, with assignment groups shown
Device compliance report for all in-scope devices, with exceptions explained
Encryption report showing BitLocker or FileVault status
Enrollment restriction configuration showing personal devices blocked
Device control policy and a sample of audit events
Update compliance and vulnerability remediation history
Intune audit log samples for admin changes
SSP sections that reference each of the above
Keep exports dated and stored somewhere that itself sits inside your compliance boundary. Assessors care about consistency over time, not a perfect screenshot taken the morning of the review.
Common gaps I find in DIB tenants
CUI users enrolled correctly, but personal phones still reaching email through the native mail app because Conditional Access only covers Windows.
BitLocker enabled, but recovery keys never escrowed because the policy was applied after encryption started.
Security baseline assigned to “All devices” in one tenant and a pilot group in another, with no record of which is authoritative.
USB blocked on laptops but not on the shop-floor PCs that run the CNC software.
No written exception process, so every one-off change becomes an undocumented deviation.
Frequently asked questions
Is Microsoft Intune CMMC compliant?
CMMC certifies the contractor, not the cloud service. Intune provides the tools to implement and evidence many NIST SP 800-171 endpoint requirements, but compliance depends on how you configure it, document it and operate it.
Do I need GCC High for CMMC Level 2?
It depends on the data. Microsoft’s guidance is that CUI Specified data, such as ITAR or export-controlled information, requires GCC High. Other CUI may be handled in GCC. Confirm your data types and contract clauses, ideally with your assessor or counsel, before choosing.
Can Intune manage CUI devices in an enclave model?
Yes. Intune policies are targeted by group, so you can apply a stricter CUI baseline, device control and Conditional Access to the enclave’s users and devices while the rest of the business uses a standard baseline.
Preparing for a CMMC assessment? Start with a free Microsoft 365 security assessment and we will show you which endpoint requirements your Intune setup already meets and where the gaps are.
If your business supplies the US Department of Defense, directly or as a subcontractor, CMMC is now part of winning and keeping contracts. Much of what an assessor wants to see on laptops and phones is something Microsoft Intune already does. This article explains where Intune CMMC work fits, which controls it covers, the cloud decisions you need to make first, and how to produce evidence an assessor will accept.
CMMC in two minutes
The Cybersecurity Maturity Model Certification is the DoD’s standard for protecting Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) across the Defense Industrial Base. Under CMMC 2.0 there are three levels:
Depending on the contract, you either self-assess or need a third-party assessment by an accredited C3PAO. Microsoft is clear that CMMC applies to the contractor’s practices, not to the cloud service itself. Using Microsoft 365 and Intune does not make you compliant. It gives you the tools to implement and evidence the controls.
Decide your cloud before you configure anything
The first question is not about Intune settings. It is where your CUI lives.
Microsoft’s own CMMC guidance states that the commercial and GCC clouds are not suitable to hold CUI Specified data, such as ITAR or export-controlled information, which needs the US sovereignty that Microsoft 365 GCC High provides. Intune is available in GCC High, but some features arrive later or work differently than in the commercial cloud, so check feature availability before you design around something.
The other decision is scope. Microsoft describes two approaches:
For a 20 to 200 person manufacturer where most staff touch drawings or specifications, “all in” is often simpler to run than it first appears. For a services firm where three engineers handle CUI, an enclave can make sense. Either way, every device that can reach CUI is in scope, and that is where Intune comes in.
Where Intune covers NIST SP 800-171 requirements
CMMC Level 2 follows the NIST SP 800-171 requirement families. Intune, working with Microsoft Entra ID and Microsoft Defender for Endpoint, supports a large share of the endpoint-related ones.
Intune does not cover everything. Physical protection, personnel security, awareness training and much of risk assessment are process and people controls. Purview handles CUI labelling and data loss prevention. The System Security Plan (SSP) ties it together.
A practical Intune build for a CUI boundary
Evidence: what assessors actually ask for
A policy that exists in Intune is not evidence until you can show it applies to every in-scope device. Build an evidence pack as you go, not the week before the assessment.
Keep exports dated and stored somewhere that itself sits inside your compliance boundary. Assessors care about consistency over time, not a perfect screenshot taken the morning of the review.
Common gaps I find in DIB tenants
Frequently asked questions
Is Microsoft Intune CMMC compliant?
CMMC certifies the contractor, not the cloud service. Intune provides the tools to implement and evidence many NIST SP 800-171 endpoint requirements, but compliance depends on how you configure it, document it and operate it.
Do I need GCC High for CMMC Level 2?
It depends on the data. Microsoft’s guidance is that CUI Specified data, such as ITAR or export-controlled information, requires GCC High. Other CUI may be handled in GCC. Confirm your data types and contract clauses, ideally with your assessor or counsel, before choosing.
Can Intune manage CUI devices in an enclave model?
Yes. Intune policies are targeted by group, so you can apply a stricter CUI baseline, device control and Conditional Access to the enclave’s users and devices while the rest of the business uses a standard baseline.
Microsoft’s overview of Microsoft and CMMC covers cloud options and planning questions. Our NIST CSF assessment maps your current controls against recognized frameworks, our Intune services build the endpoint side, and our migration projects cover moves into a government cloud. For CUI labelling, see our sensitivity labels work.
Preparing for a CMMC assessment? Start with a free Microsoft 365 security assessment and we will show you which endpoint requirements your Intune setup already meets and where the gaps are.