Intune

102 checks56 High33 Medium13 Low

Endpoint security25Tenant administration20Device compliance20App protection19Device configuration12Device enrollment6

Run theseInvoke-Maester -Product intuneCopy

102 checks

Group byFeatureAreaSeveritySuiteNone

IDCheckFeatureSeverity

ASD.ISM-1667Microsoft Office is blocked from creating child processes.New in 3.0Endpoint securityHighASD.ISM-1668Microsoft Office is blocked from creating executable content.New in 3.0Endpoint securityHighASD.ISM-1669Microsoft Office is blocked from injecting code into other processes.New in 3.0Endpoint securityHighASD.ISM-1673Microsoft Office macros are blocked from making Win32 API calls.New in 3.0Endpoint securityHighASD.ISM-1695Patches for vulnerabilities in the operating systems of workstations are applied within one month of release.New in 3.0Device configurationHighMT.1092Intune APNS certificate should be valid for more than 30 daysTenant administrationHighMT.1093Apple Automated Device Enrollment Tokens should be valid for more than 30 daysTenant administrationHighMT.1094Apple Volume Purchase Program Tokens should be valid for more than 30 daysTenant administrationHighMT.1095Android Enterprise account connection should be healthyTenant administrationHighMT.1097Ensure all Intune Certificate Connectors are healthy and running supported versionsTenant administrationHighMT.1098Mobile Threat Defense Connectors should be healthyTenant administrationHighMT.1100Intune Diagnostic Settings should include Audit LogsTenant administrationHighMT.1102Windows Feature Update Policy Settings should not reference end of support buildsDevice configurationHighMT.1103Ensure Intune RBAC groups are protected by Restricted Management Administrative Units or Role Assignable groupsTenant administrationHighMT.1123Ensure BitLocker full disk encryption is configuredEndpoint securityHighMT.1178Ensure ASR Rules are configured correctly.Endpoint securityHighMT.1179Ensure App Control for Business is enabled.Endpoint securityHighMT.1217Ensure macOS LAPS is configured on Automated Device Enrollment profiles.Device enrollmentHighZTA.24540Windows Firewall policy is created and assignedZTAEndpoint securityHighZTA.24541A compliance policy for Windows devices existsZTADevice complianceHighZTA.24542macOS Compliance policy is created and assignedZTADevice complianceHighZTA.24543Compliance policy assignment for iOS/iPadOS devicesZTADevice complianceHighZTA.24545Compliance policy assignment for Android Enterprise Fully managed device is configured and assignedZTADevice complianceHighZTA.24546Windows automatic device enrollment is enforced to eliminate risks from unmanaged endpointsZTADevice enrollmentHighZTA.24547Compliance Policy for Android Enterprise Personally-Owned Work Profile is configured and assignedZTADevice complianceHighZTA.24548App Protection Policy assigned on iOS/iPad devicesZTAApp protectionHighZTA.24549An App protection policy for Android platform exists in IntuneZTAApp protectionHighZTA.24550Windows - BitLocker Policy is created and assignedZTAEndpoint securityHighZTA.24551Windows Hello for Business Policy is Configured and AssignedZTADevice enrollmentHighZTA.24553Windows Update policy is assigned and enforced.ZTADevice configurationHighZTA.24554iOS - Update policy is configured and assignedZTADevice configurationHighZTA.24555Intune Scope Tags are Configured for Delegated AdministrationZTATenant administrationHighZTA.24560Windows Cloud LAPS policy is created and assignedZTAEndpoint securityHighZTA.24561Local administrator credentials on macOS are protected during enrollment by macOS LAPSZTADevice enrollmentHighZTA.24564Windows - Local Account Protection policy is configured and assignedZTAEndpoint securityHighZTA.24568macOS - Platform SSO is configured and assignedZTADevice configurationHighZTA.24569Intune macOS FileVault policy is created and AssignedZTAEndpoint securityHighZTA.24572Device enrollment notification is configured and assignedZTADevice enrollmentHighZTA.24573Windows - A security baseline is configured and assignedZTAEndpoint securityHighZTA.24574Deploy Attack Surface Reduction Policies (ASR) policies for Windows devicesZTAEndpoint securityHighZTA.24575A Windows Defender Antivirus policy is created and assignedZTAEndpoint securityHighZTA.24690macOS - Update policy is configured and assignedZTADevice configurationHighZTA.24784A Microsoft Defender Antivirus policy is created and assigned in Intune for macOSZTAEndpoint securityHighZTA.24794Intune Terms and Conditions Policy is configured and assignedZTATenant administrationHighZTA.24802Device Clean-up Rule is CreatedZTATenant administrationHighZTA.24839Secure Wi-Fi profiles protect iOS devices from unauthorized network accessZTADevice configurationHighZTA.24840Secure Wi-Fi profiles protect Android devices from unauthorized network accessZTADevice configurationHighZTA.24870Secure Wi-Fi profiles protect macOS devices from unauthorized network accessZTADevice configurationHighZTA.24871Defender for Endpoint automatic enrollment is enforced to reduce risk from unmanaged Android threatsZTATenant administrationHighZTA.41050Attack surface reduction (ASR) rules are enabled in block modeZTAEndpoint securityHighZTA.41052Application control (WDAC / App Control for Business) is enforced via IntuneZTAEndpoint securityHighZTA.51001Windows Endpoint Privilege Management is configured and assignedZTAEndpoint securityHighZTA.51013App Protection Policies block managed-app access when user re-authentication fails (disabled Entra ID accounts, blocked sign-ins, expired tokens)ZTAApp protectionHighZTA.51014App Protection Policies block managed-app access on jailbroken or rooted mobile devicesZTAApp protectionHighZTA.51015Multi Admin Approval is enabled in Intune to require a second admin to approve sensitive tenant changesZTATenant administrationHighZTA.51018Windows App Control for Business (WDAC) is configured and assigned via IntuneZTAEndpoint securityHighASD.ISM-1488Microsoft Office macros in files originating from the internet are blocked.New in 3.0Device configurationMediumASD.ISM-1672Microsoft Office macro antivirus scanning is enabled.New in 3.0Device configurationMediumCIS.M365.4.1Ensure devices without a compliance policy are marked 'not compliant'Device complianceMediumCIS.M365.4.2Ensure device enrollment for personally owned devices is blocked by defaultNew in 3.0Device enrollmentMediumMT.1054Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'Device complianceMediumMT.1096Ensure at least one Intune Multi Admin Approval policy is configuredTenant administrationMediumMT.1177Ensure LAPS Configuration Policy is properly set.Endpoint securityMediumMT.1180Ensure Managed Installer Rules are configured correctly.Endpoint securityMediumMT.1214Ensure macOS compliance policy requires System Integrity Protection.Device complianceMediumMT.1215Ensure Gatekeeper restricts macOS app download locations.Device complianceMediumMT.1216Ensure macOS compliance policy requires a Defender machine risk score level.Device complianceMediumMT.1228Ensure iOS compliance policy blocks jailbroken devices.New in 3.0Device complianceMediumMT.1229Ensure iOS compliance policy requires a strong device passcode.New in 3.0Device complianceMediumMT.1230Ensure iOS compliance policy requires a minimum operating system version.New in 3.0Device complianceMediumMT.1231Ensure iOS compliance policy requires a Defender machine risk score level.New in 3.0Device complianceMediumMT.1232Ensure Android compliance policy blocks rooted devices.New in 3.0Device complianceMediumMT.1233Ensure Android compliance policy requires a strong device password.New in 3.0Device complianceMediumMT.1234Ensure Android compliance policy requires a recent security patch level.New in 3.0Device complianceMediumMT.1235Ensure Android compliance policy requires device threat protection.New in 3.0Device complianceMediumMT.1238Ensure iOS app protection policy requires a strong app PIN.New in 3.0App protectionMediumMT.1239Ensure iOS app protection policy keeps organization data inside managed apps.New in 3.0App protectionMediumMT.1240Ensure iOS app protection policy encrypts organization data.New in 3.0App protectionMediumMT.1243Ensure iOS app protection policy acts on the device threat level.New in 3.0App protectionMediumMT.1244Ensure Android app protection policy requires a strong app PIN.New in 3.0App protectionMediumMT.1245Ensure Android app protection policy keeps organization data inside managed apps.New in 3.0App protectionMediumMT.1246Ensure Android app protection policy encrypts organization data.New in 3.0App protectionMediumMT.1249Ensure Android app protection policy acts on the device threat level.New in 3.0App protectionMediumMT.1251Ensure Android app protection policy requires Play Integrity device attestation.New in 3.0App protectionMediumZTA.24552macOS - Firewall policy is created and assignedZTAEndpoint securityMediumZTA.24823Company Portal branding and support settings enhance user experience and trustZTATenant administrationMediumZTA.41049The Microsoft Defender Antivirus user interface is hidden from end usersZTAEndpoint securityMediumZTA.41051Removable storage and device control policies are enforced via IntuneZTAEndpoint securityMediumZTA.51019MAM app access timeout and re-authentication are enforced after idle periodZTAApp protectionMediumASD.ISM-1654Internet Explorer 11 is disabled or removed.New in 3.0Device configurationLowMT.1053Ensure intune device clean-up rule is configuredTenant administrationLowMT.1099Windows Diagnostic Data Processing should be enabledTenant administrationLowMT.1101Default Branding Profile should be customizedTenant administrationLowMT.1105Ensure MDM Authority is set to IntuneTenant administrationLowMT.1236Ensure Android compliance policy blocks USB debugging.New in 3.0Device complianceLowMT.1237Ensure Android compliance policy blocks devices managed with device administrator.New in 3.0Device complianceLowMT.1241Ensure iOS app protection policy requires a minimum OS and app version.New in 3.0App protectionLowMT.1242Ensure iOS app protection policy limits offline access to organization data.New in 3.0App protectionLowMT.1247Ensure Android app protection policy requires a minimum OS and app version.New in 3.0App protectionLowMT.1248Ensure Android app protection policy limits offline access to organization data.New in 3.0App protectionLowMT.1250Ensure Android app protection policy blocks screen capture of organization data.New in 3.0App protectionLowZTA.24576Intune Endpoint Analytics policy is created and AssignedZTATenant administrationLow