Intune security baselines are one of the fastest ways to harden Windows devices. With a few clicks you apply hundreds of settings that Microsoft’s security teams recommend. That speed is also the danger: assign a baseline to every device on a Tuesday and by Wednesday the accounting app will not print, the old scanner cannot save to the file share, and someone’s VPN client refuses to connect.
This guide explains how to deploy Intune security baselines in a way that hardens devices without breaking the line-of-business apps your staff depend on.
What a security baseline is
A security baseline is a preconfigured group of Windows settings, delivered through Intune, that reflects Microsoft’s recommended security configuration. You find them in the Microsoft Intune admin center at Endpoint security > Security baselines. The main ones are:
Security Baseline for Windows 10 and later: the core operating system hardening set, released in versions that follow Windows releases.
Microsoft Defender for Endpoint baseline: antivirus, attack surface reduction, firewall and related settings. It requires a Defender for Endpoint environment.
Microsoft Edge baseline: browser security settings.
Microsoft 365 Apps for Enterprise baseline: Office hardening, including macro and add-in controls.
Windows 365 Security Baseline: for Cloud PCs.
Each baseline you create is a profile you can customize before you assign it. You can run several baselines at once and even several instances of the same baseline with different customizations.
Why baselines break apps
Baselines are written for a well-maintained, modern environment. Most small and mid-sized businesses have at least a few things that are not modern: a practice management system from 2014, a NAS in the closet, a vendor’s remote support tool. These are the areas where I see baselines cause trouble most often:
Area
Typical symptom
Usual cause
SMB and NTLM hardening
Old NAS, copier or scanner cannot reach shares
Device only supports SMBv1, unsigned SMB or NTLMv1
Legacy authentication components that hook into LSA
Attack surface reduction rules
Office macros, add-ins or report tools stop working
Rules that block Office child processes or untrusted executables
Office macro and add-in controls
Excel templates and accounting add-ins disabled
Macros from the internet blocked, unsigned add-ins disabled
Remote access and RDP settings
Vendor support tool or RDP clipboard stops working
Device redirection and remote assistance restricted
Legacy TLS and protocols
Old web apps fail to load
Weak protocols disabled
None of these are reasons to skip the baseline. They are reasons to find the problem in a pilot, not in production.
Before you deploy: inventory and test plan
List your line-of-business apps. Accounting, practice management, EHR, CAD, ERP, scanning, printing, VPN, remote support. Name one owner per app who can test it.
List the devices that talk to PCs. Printers, scanners, NAS units, door access systems. These are often the first things to break under SMB and NTLM changes.
Write a five-minute test script per app. Open it, sign in, run a report, print, save to the share. Simple and repeatable.
Check what is already configured. Baselines manage settings you may already set with Group Policy, configuration profiles or endpoint security policies. Overlaps produce conflicts.
A ring-based rollout
I deploy baselines in rings, the same way you would deploy Windows updates:
Ring 0, IT devices. Assign the baseline to IT staff for a week. Fix anything obvious.
Ring 1, app owners. One device per department, run by the person who owns that department’s critical app. They run the test script.
Ring 2, broad pilot. Ten to twenty percent of devices across departments for one to two weeks.
Ring 3, everyone. Assign to all managed Windows devices.
For attack surface reduction rules, use Audit mode first wherever possible. Audit events in Microsoft Defender XDR show exactly which app and process would have been blocked. Switch each rule to Block once you have reviewed the audit data and added the minimum exclusions needed.
Customize, do not abandon
When a setting breaks an app, change that one setting in the baseline profile, document why, and keep the rest. For example, if a legacy NAS needs an exception, the right long-term fix is often to replace or update the NAS, with the baseline exception as a temporary measure with a review date.
Monitoring and resolving conflicts
After assignment, monitor at Endpoint security > Security baselines > [baseline] > Profiles > [profile]. Device and per-setting status show Succeeded, Error, Conflict or Not applicable. Data can take up to 24 hours to appear after the first assignment.
Conflicts mean two policies set the same setting to different values. Drill into the device’s configuration report to see the source profiles, then decide which policy owns that setting and remove it from the other. My rule: every setting has exactly one source of truth.
Keeping baselines current
Microsoft releases new baseline versions as Windows and its security guidance change. Older versions keep working but cannot have their settings edited. To move forward, select the profile and choose Update Version. You can keep your customizations or discard them. Intune creates a new profile; the original stays in place until you move the assignments across.
Treat each version update like a mini rollout: compare the changes, push the new version to Ring 0 and Ring 1, then reassign everyone. Remove assignments from the old profile when you move them, so devices do not receive both.
Be aware that unassigning a baseline does not always return every setting to its previous value on the device. Plan your rollback as “deploy the corrected setting” rather than “remove the policy”.
Frequently asked questions
Can I use more than one security baseline at the same time?
Yes. You can combine the Windows, Defender for Endpoint, Edge and Microsoft 365 Apps baselines, and run multiple instances with different customizations. Review overlapping settings so different baselines do not set conflicting values.
Do Intune security baselines replace Group Policy?
For Entra joined devices, yes, they provide cloud-delivered equivalents of most Microsoft security baseline GPOs. For hybrid joined devices still receiving Group Policy, make sure the same setting is not configured in both places.
What should I do if a baseline setting breaks an application?
Customize that setting in the baseline profile for the affected devices, document the reason and set a review date. Keep the rest of the baseline applied, and work with the vendor on a fix so the exception can be removed.
Intune security baselines are one of the fastest ways to harden Windows devices. With a few clicks you apply hundreds of settings that Microsoft’s security teams recommend. That speed is also the danger: assign a baseline to every device on a Tuesday and by Wednesday the accounting app will not print, the old scanner cannot save to the file share, and someone’s VPN client refuses to connect.
This guide explains how to deploy Intune security baselines in a way that hardens devices without breaking the line-of-business apps your staff depend on.
What a security baseline is
A security baseline is a preconfigured group of Windows settings, delivered through Intune, that reflects Microsoft’s recommended security configuration. You find them in the Microsoft Intune admin center at
Endpoint security > Security baselines. The main ones are:Each baseline you create is a profile you can customize before you assign it. You can run several baselines at once and even several instances of the same baseline with different customizations.
Why baselines break apps
Baselines are written for a well-maintained, modern environment. Most small and mid-sized businesses have at least a few things that are not modern: a practice management system from 2014, a NAS in the closet, a vendor’s remote support tool. These are the areas where I see baselines cause trouble most often:
None of these are reasons to skip the baseline. They are reasons to find the problem in a pilot, not in production.
Before you deploy: inventory and test plan
A ring-based rollout
I deploy baselines in rings, the same way you would deploy Windows updates:
For attack surface reduction rules, use Audit mode first wherever possible. Audit events in Microsoft Defender XDR show exactly which app and process would have been blocked. Switch each rule to Block once you have reviewed the audit data and added the minimum exclusions needed.
Customize, do not abandon
When a setting breaks an app, change that one setting in the baseline profile, document why, and keep the rest. For example, if a legacy NAS needs an exception, the right long-term fix is often to replace or update the NAS, with the baseline exception as a temporary measure with a review date.
Monitoring and resolving conflicts
After assignment, monitor at
Endpoint security > Security baselines > [baseline] > Profiles > [profile]. Device and per-setting status show Succeeded, Error, Conflict or Not applicable. Data can take up to 24 hours to appear after the first assignment.Conflicts mean two policies set the same setting to different values. Drill into the device’s configuration report to see the source profiles, then decide which policy owns that setting and remove it from the other. My rule: every setting has exactly one source of truth.
Keeping baselines current
Microsoft releases new baseline versions as Windows and its security guidance change. Older versions keep working but cannot have their settings edited. To move forward, select the profile and choose Update Version. You can keep your customizations or discard them. Intune creates a new profile; the original stays in place until you move the assignments across.
Treat each version update like a mini rollout: compare the changes, push the new version to Ring 0 and Ring 1, then reassign everyone. Remove assignments from the old profile when you move them, so devices do not receive both.
Be aware that unassigning a baseline does not always return every setting to its previous value on the device. Plan your rollback as “deploy the corrected setting” rather than “remove the policy”.
Frequently asked questions
Can I use more than one security baseline at the same time?
Yes. You can combine the Windows, Defender for Endpoint, Edge and Microsoft 365 Apps baselines, and run multiple instances with different customizations. Review overlapping settings so different baselines do not set conflicting values.
Do Intune security baselines replace Group Policy?
For Entra joined devices, yes, they provide cloud-delivered equivalents of most Microsoft security baseline GPOs. For hybrid joined devices still receiving Group Policy, make sure the same setting is not configured in both places.
What should I do if a baseline setting breaks an application?
Customize that setting in the baseline profile for the affected devices, document the reason and set a review date. Keep the rest of the baseline applied, and work with the vendor on a fix so the exception can be removed.
We deploy baselines this way in our endpoint security baseline service. If you also need the Defender side tuned, see Defender for Endpoint, and for an outside view of your controls, the NIST CSF assessment. Microsoft’s overview is Use security baselines to help secure Windows devices.
Want baselines in place without the Wednesday morning surprises? Start with a free Microsoft 365 security assessment.