SkipToTheEndpoint / OpenIntuneBaseline

# OpenIntuneBaseline
 | 
 | 
---
> [!IMPORTANT]
> This has been developed as a starting point or foundation and is not necessarily considered "complete". It is being made available to allow learning, development, and knowledge-sharing amongst communities.
>
> No liability is assumed for the usage or application of the settings within this project in production tenants.
---
## About the Author
James is a Technical Architect and Microsoft MVP in both Intune and Windows, and has been working in the IT industry for over 20 years, with the last 8 being primarily within Intune. He is also a recognised contributor to the CIS Windows Benchmarks.
He has a wealth of experience across the Microsoft 365 stack, with a focus on security and compliance, and is a regular attendee and speaker at community events such as MMS and Workplace Ninja Summit, and is passionate about sharing knowledge and helping others.
---
## About the Project
### Project History
The OpenIntuneBaseline (OIB) project was started in early 2021 as a way to provide a "known good" baseline security posture for Windows devices managed by Microsoft Intune, after being disappointed with the admin and user experience of other available baselines.
### Security Framework Adherence
When creating the initial Windows baseline, substantial data analysis was carried out over well-known security frameworks, such as:
* NCSC Device Security Guidance
* CIS Windows Benchmarks
* ACSC Essential Eight
* Intune Security Baselines for Windows, Edge & Defender for Endpoint
* Microsoft Best Practice
The OIB was not created by simply applying the recommendations from these frameworks. While there is obviously significant overlap, I was driven to create something that included a number of user-experience additions not seen in the above frameworks, as well as my own significant experience implementing these across multiple customer environments, and how admin managability can be impacted by doing so.
Security frameworks tend to be seen as unmovable hard requirements rather than what they are, which is a set of **recommendations**. In fact, the CIS themselves preface their benchmarks with the following:
> It is acceptable if _**100% of the benchmark is not applied**_, as it is the responsibility and decision of each organization to determine which settings are applicable to their unique needs.
It is **impossible** to create a true "one-size-fits-all" set of policies due to the massively differing nature of enterprise requirements. There is also a significant amount of "noise" in the security community, with many recommending settings that are not necessarily required or beneficial, such as enforcing default behaviour that a standard user cannot change, or settings that have been included in GPO baselines since the days of Windows 7. 
This baseline is designed to be a starting point or guide, and all configurations applied to an environment regardless of source should be reviewed and adjusted to suit your own business