Secure Microsoft workplace
Intune security baselines that fit, work and can be demonstrated.
Switching on a baseline from the book is easy. Applying it so nothing breaks, every deviation has a rationale, and you can show where you stand: that is where the work is.
Sound familiar?
- A security baseline is enabled, but nobody remembers why certain settings were switched off.
- GPOs, Intune profiles and baselines contradict each other, and the outcome per device is unclear.
- The auditor or regulator asks for evidence, and it isn’t in one place.
- Hardening measures such as Credential Guard or ASR rules were postponed for fear of disruption.
What you get
- A baseline in Intune (settings catalog) that fits your organisation
- A register of deviations with their rationale
- Reporting per setting and per device
- Cleaned-up GPOs, or a plan to phase them out
- Microsoft Intune
- Windows Autopilot
- Entra join
- CIS Benchmarks
- Security baselines
- Defender for Endpoint
Secure Microsoft workplace
How we approach it
Inventory
Map current GPOs, Intune profiles and baselines, including conflicts and duplicates.
Choose
CIS or the Microsoft baseline as the starting point, with a rationale for every deviation that fits your risk.
Test and roll out
In phases through pilot groups, monitoring the impact before going wide.
Demonstrate
Compliance reporting per setting, so in an audit you show rather than tell.
Frequently asked questions
CIS or the Microsoft security baseline: which should I choose?
The Microsoft baseline is a good, pragmatic starting point that Microsoft maintains. CIS goes further on many points and is often what auditors ask for. We choose a starting point together and record why for every deviation, so the result stays explainable.
Will users suffer from the hardening?
We prevent that by rolling out in phases through pilot groups and measuring the impact first, for example with ASR rules in audit mode. Measures that break something are adjusted or documented as an exception.
What licences do I need?
Managing through Intune requires Intune licences, for example through Microsoft 365 E3, E5 or Business Premium. Some measures, such as Credential Guard, require Windows Enterprise or Education.
Can we move from GPO to Intune without rebuilding everything?
Yes. We analyse which GPO settings are still needed, move those to the settings catalog and clean up the rest. Often a large part turns out to be redundant or already covered by the baseline.
How do I show that we comply?
Intune reports per setting and per device whether it complies. Together with the deviation register, that is the evidence auditors and regulators ask for.
Start with a 20-minute intake.
We discuss your situation and tell you honestly whether and how we can help, even if the answer is ‘you don’t need this’. You’ll hear from us within two business days.