Intune security baselines: how to use them well, and what to do when a new version ships

The main baselines

Windows: the operating system’s security settings. Most organizations start here.
Microsoft Defender for Endpoint: antivirus settings, ASR rules and network protection.
Microsoft Edge: browser security settings.
Microsoft 365 Apps: security settings for the Office apps.
Windows 365: settings for Cloud PCs.

You can tailor each baseline: change a value that doesn’t fit you, and keep the rest as Microsoft recommends.

What happens when a new version ships

This is the part organizations miss. According to Microsoft:

Existing profiles don’t update automatically. They keep running the previous version.
Their settings become read-only. You can change the name, description and assignments, but not the settings themselves.
An update creates a new profile next to the old one. With Update Version you choose to keep your customizations or start from the defaults.
Assignments and scope tags aren’t carried over to the new profile. You set them again.
A setting dropped from the baseline isn’t reset on the device. It stays as it was until something else manages it.

Microsoft recommends updating to the latest version as soon as it’s practical. A new version adds settings, removes ones that are no longer supported, and changes defaults to match current recommendations.

What to know about 26H2

The baseline brings new settings, updated defaults and revised security guidance. Microsoft publishes the full breakdown on its Security Baselines blog.
The Configure NetBIOS settings policy is not included in this release, because it’s currently supported only on Insider builds. Microsoft plans to add it in a future update.
Before moving from a previous version, and especially if you customized it, Microsoft recommends reviewing the settings.

A recommended update workflow

Read what changed. Intune lets you download a CSV comparing the current and new versions: which settings were added, removed or changed.
Create the new version next to the old one. Use Update Version, and keep your customizations if they still make sense.
Test on a pilot group. Assign the new profile to a small group and check compliance and device behavior.
Move assignments in stages. Add groups to the new profile and remove them from the old one, so both don’t apply to the same devices.
Delete the old one last. Once it’s no longer assigned to any group.
Watch the reports. Intune reports show which devices don’t match the baseline, so you can fix them quickly.

At OnCloud we manage security settings for more than half a million endpoints across our customers, and we update their security baselines with every release: we review what changed, run a pilot and move the organization over without breaking devices. Want to check which version you’re on?