How to Align Client Policies with CIS Controls Using Intune Profiles Security is only one part of the challenge for MSPs managing multiple tenants; consistency, audit preparedness, and risk reduction are equally critical. To meet these goals, many IT teams turn to Microsoft Intune to align Windows security policies with standards set by the Center for Internet Security. Before we begin, be sure to subscribe to NinjaOne’s IT video hub and our YouTube channel for more tech content like this. Overview of Prerequisites First things first—make sure the following prerequisites are in place: A Microsoft 365 Business Premium or Enterprise license Microsoft Intune licensing and device enrollment Global administrator or Intune admin roles PowerShell version 5.1 or later Azure AD–joined or hybrid-joined Windows 10 or 11 devices Familiarity with CIS benchmarks, Levels 1 and 2 Keep in mind that some steps may vary depending on your environment or existing configurations. There are a couple of ways to enforce CIS controls using Intune. Let’s start with the easiest one: using the Intune settings catalog. How to Align Client Policies with CIS Controls Using Intune Profiles Method 1 — Using the Intune Settings Catalog Start by downloading the latest CIS benchmark for Windows 10 or Windows 11 Identify which controls apply to your environment: Level 1 or Level 2. Next, open the Microsoft Intune Admin Center and navigate to Devices, followed by Configuration profiles. Create a new profile using this information: Platform: Windows 10 and later Profile type: Settings catalog From here, search for settings that align with CIS recommendations. Common examples include account lockout policies, BitLocker encryption, Microsoft Defender configuration, Remote Desktop restrictions, and application install control. Be sure to document each mapping for audit readiness and long-term policy management. Method 2 — Applying Configuration Profiles Across Multiple Tenants For MSPs and multi-tenant environments, exporting and importing configuration profiles helps maintain consistency across customers. You can use Microsoft Lighthouse to deploy shared security templates across tenants. Alternatively, you can export and import Intune configuration profiles using PowerShell or the Microsoft Graph API. For example, exporting a CIS Level 1 profile creates a reusable JSON file that can be imported into another tenant. This involves running the following scripts: Keep in mind that these scripts may run silently, without confirmation messages. To validate success, you’ll need to confirm registry keys or system settings directly on the endpoint. Method 3 — Using Group Policy Lastly, for organizations still managing on-prem or hybrid environments, Group Policy can serve as a bridge or fallback. Simply open the Group Policy Management Console and navigate to Computer Configuration → Administrative Templates → System → Device Guard. Here, you can enable virtualization-based security, credential guard, and secure boot. Group Policy can also be exported for reference when converting settings to Intune. If needed, run the gpupdate /force command to apply changes immediately, or wait for the next policy refresh cycle. In the end, aligning Windows endpoints with CIS controls through Intune creates a consistent and enforceable security standard. For more information, check out our official blog post on enforcing CIS controls using Intune, linked in the description below.