Most ransomware now arrives through a device nobody manages.
Is your Intune configuration actually protecting you?
Most organizations switch Intune on, enroll devices and move on. Policies pile up, exceptions are forgotten, and the settings that matter most, like enforcing compliance at sign-in, managing local administrator passwords or escrowing BitLocker keys, are often missing.
The Microsoft Intune security audit reviews every policy, assignment and device state against 127 best-practice checks, then turns what we find into business risks, a prioritized roadmap and plain-English reports for leadership and IT.
127 checks across the 15 areas of your Intune tenant
Windows, macOS, iOS/iPadOS and Android Enterprise are all covered. Pick an area to see example checks; the full list is on the checklist page.
Tenant & Service Configuration
Tenant-wide settings that decide how Intune treats every device, including what happens to devices with no compliance policy.
TEN-01Intune subscription is active and MDM authority is IntuneCriticalTEN-02Devices with no compliance policy are treated as not compliantHighTEN-03Compliance status validity period is 30 days or lessMediumTEN-05Android device administrator enrollment is disabledMediumTEN-06Device clean-up rule retires stale devicesMediumEnrollment & Windows Autopilot
Who can enroll which devices, personal-device rules, Autopilot profiles and Windows Hello for Business.
ENR-01Personal (BYOD) Windows enrollment is blocked unless intendedHighENR-05Windows Hello for Business is enabled with TPM and a strong PINHighENR-08MDM user scope and MFA for device registration are configuredHighENR-02Personal Android and iOS enrollment is restricted or covered by app protectionMediumENR-03Minimum OS versions are enforced at enrollmentMediumDevice Compliance
Whether every platform has a compliance policy, what it requires, and what happens when a device falls out of compliance.
CMP-01A compliance policy exists and is assigned for every enrolled platformCriticalCMP-02Windows compliance requires BitLocker, Secure Boot and code integrityHighCMP-03Windows compliance requires Defender antivirus, real-time protection and firewallHighCMP-06Mobile compliance blocks jailbroken/rooted devices and requires a passcode and encryptionHighCMP-09Device compliance rate is 90% or betterHighDevice Configuration
Configuration profiles, assignment scope, conflicts, Edge and SmartScreen, removable media and assignment groups.
CFG-04Device configuration policies report low error and conflict ratesMediumCFG-05A device-lock / password policy is applied to Windows devicesMediumCFG-07Microsoft Edge / SmartScreen protections are enforcedMediumGRP-01Assignment groups are not emptyMediumGRP-02Dynamic assignment groups process without errorsMediumEndpoint Security
Defender Antivirus, tamper protection, ASR rules, firewall, BitLocker, LAPS, Credential Guard and CIS-aligned hardening.
SEC-01A Microsoft Defender Antivirus policy is assigned to Windows devicesCriticalSEC-02Real-time protection is enforcedCriticalSEC-10BitLocker full-disk encryption is enforced with recovery keys escrowed to Entra IDCriticalSEC-03Cloud-delivered protection at High or higherHighSEC-05Behavior monitoring is enabledHighUpdate Management
Update rings, feature and driver updates, expedited patches, current builds and Windows 11 readiness.
UPD-01Windows Update rings are assigned with deadlines and short deferralsHighUPD-02Windows feature update policy keeps devices on a supported versionHighUPD-05Managed devices run current OS buildsMediumUPD-06Windows 10 devices are assessed for Windows 11 upgrade eligibilityMediumUPD-03Driver updates are managed (automatic or manual approval)LowApplication Management
Required apps, failed and orphaned packages, Store access and end-of-life or high-risk software.
APP-05No end-of-life, vulnerable or high-risk applications on managed devicesHighAPP-01Required security and productivity apps are deployedMediumAPP-02Unassigned and failed app packages are cleaned upLowAPP-03Microsoft Store / marketplace access is controlledLowAPP-04Win32 apps are deployed with detection rules and requirementsInfoApp Protection (MAM)
Mobile app protection: PINs, copy/paste and save-as restrictions, and device conditions for company data.
MAM-01App protection policies exist for iOS and AndroidHighMAM-03App protection restricts data transfer, backup, save-as and clipboardHighMAM-02App protection requires a PIN, blocks simple PINs and wipes after retriesMediumMAM-04App protection enforces device conditions (jailbreak, min OS, device compliance)MediumMAM-05Windows app protection (Edge MAM) or WIP covers unmanaged Windows accessInfoDevice Inventory & Hygiene
Stale devices, jailbroken or rooted devices, personal devices, Entra join state and unmanaged sign-ins.
DEV-02No jailbroken or rooted devices are enrolledHighDEV-01Stale managed devices are removedMediumDEV-04Entra devices are managed and compliantMediumDEV-07Every active user works from a managed device (shadow-IT signal)MediumDEV-03Personal devices are only enrolled where a BYOD program existsLowIdentity & Conditional Access
Whether Conditional Access actually enforces device compliance, MFA, app protection and blocks legacy sign-in.
IDN-01Conditional Access requires a compliant device for corporate resourcesCriticalIDN-02Conditional Access requires MFA for all users and for device enrollmentCriticalIDN-03Conditional Access requires approved apps / app protection on mobileHighIDN-04Legacy authentication is blocked by Conditional AccessHighIDN-05Intune administrators are protected by MFA/device requirementsHighAdministration & RBAC
Global Administrators, just-in-time (PIM) access, MFA for admins, dormant admins and scoped Intune roles.
PRV-02All administrators are registered for MFA (phishing-resistant preferred)CriticalRBC-01Global Administrator role is limited to 2-4 accountsHighPRV-01Privileged roles use PIM eligible (just-in-time) assignmentsHighRBC-02Intune administration uses scoped roles rather than Global AdministratorMediumRBC-04Administrator accounts are cloud-only, enabled and in useMediumConnectors & Integrations
Defender for Endpoint connector, Apple push certificate, VPP and enrollment tokens, Managed Google Play and certificate connectors.
CON-02Apple MDM push certificate is valid and not close to expiryCriticalCON-01Microsoft Defender for Endpoint connector is enabled for all platformsHighCON-03Apple VPP and Automated Device Enrollment tokens are valid and syncingHighCON-08No certificate, token or connector expires within 90 daysHighCON-04Managed Google Play is connected for Android EnterpriseMediumScripts & Remediations
PowerShell and shell scripts: embedded passwords or secrets, signing and remediation scripts.
SCR-01Deployed scripts contain no embedded credentials or secretsCriticalSCR-02Scripts run with signature checks or from a controlled processLowSCR-03Proactive remediations are used for security hygieneInfoMonitoring & Audit
Audit log review, remote wipe and retire actions, alert rules and enrollment terms.
AUD-01Intune audit log is active and reviewedMediumAUD-02Remote actions (wipe, retire, reset) are limited and reviewedLowAUD-03Intune alert rules are configuredLowAUD-04Terms and conditions are presented at enrollmentInfoPolicy Application Status
Whether policies, scripts and apps actually apply on devices without errors or conflicts.
STA-01Compliance policies evaluate without errors or conflictsHighSTA-02Configuration profiles apply without errors or conflictsMediumSTA-03Endpoint security (legacy template) policies apply without errorsMediumSTA-06Required applications install successfullyMediumSTA-09App protection: no flagged (rooted/jailbroken) app registrationsMediumExactly what your administrator will see
The audit reads your configuration; it never changes it. Here is everything that happens on your side, so there are no surprises.
Fixes are made by your IT team, your MSP or IT Perfection, never by the audit itself.
| Item | What happens |
|---|---|
| Access needed | A Global Reader account, or a read-only app registration your administrator creates. No write permissions are ever requested. |
| Requests made | Microsoft Graph read requests only. Every request is logged and handed over as part of the evidence. |
| What the admin sees | Microsoft’s normal sign-in and, the first time only, a permissions consent screen for Microsoft’s “Microsoft Graph Command Line Tools” app. |
| What users see | Nothing. No agent is installed, no device is touched and no user receives a prompt. |
| What appears in logs | A sign-in entry and, on first use, the consent record. Conditional Access may evaluate that sign-in like any other. |
What an Intune audit typically uncovers
From the sample report for Calder Ridge Partners, a fictional company. Real client findings are confidential and never published.
| Finding (SAMPLE) | Severity | Business risk |
|---|---|---|
| Conditional Access does not require a compliant device | Critical | Unmanaged devices reach company data |
| 14 Windows devices have no BitLocker recovery key in Entra ID | High | Lost or stolen device exposes data |
| Windows LAPS does not manage local administrator passwords | High | Credential theft and lateral movement |
| Seven Global Administrator accounts (target 2-4) | High | Privileged account misuse |
| Apple MDM push certificate expires within 90 days | High | Apple device management outage |
Sample score: 65.0 / 100 (Needs improvement) · 48 findings · 14 business risks.
A report pack leadership and IT can both use
Every deliverable is written by the assessor in plain English. See every page of the sample report →
| Deliverable | What it contains | Who uses it |
|---|---|---|
| Executive Security Report | Score, top business risks, what is working, priority actions and decisions for leadership | Owners, executives |
| Security Scorecard (one page) | Score, area scores and top priorities on a single page | Leadership, board |
| Best-Practice Gap Assessment | Every finding with evidence, business impact, fix and NIST / ISO / CIS mapping | IT team, MSP |
| Current Configuration Report | Every Intune policy and setting as found, with a contents page | IT team, auditors |
| Risk Register | Business risks scored by likelihood and impact, heat maps, owners and target dates | Leadership, compliance |
| Next Steps & Security Roadmap | 0-7, 7-30, 30-90 and 90-180 day actions, projects and governance | IT team, leadership |
| Workbooks and readout deck | Excel findings tracker, device and app inventories, and an executive readout presentation | IT team, leadership |
Five steps from scoping call to readout
The audit is remote-friendly and needs only a short amount of your administrator’s time: one sign-in with read-only access.
Scoping call
Platforms, number of devices, compliance drivers (HIPAA, IRS WISP, insurance) and your concerns.
Read-only access
Your administrator signs in once with a Global Reader account, or creates a read-only app registration for us.
Review against 127 checks
Every policy, assignment, connector and device state is reviewed across Windows, macOS, iOS/iPadOS and Android.
Assessor review
Ali reviews every finding, adjusts severity where your context calls for it and writes the business impact.
Readout and report pack
A walk-through with leadership and IT, the full report pack and a prioritized 180-day roadmap.
Built for the businesses that depend on their laptops and phones
Healthcare & dental
Encryption, device access and audit evidence for HIPAA technical safeguards.
Healthcare cybersecurity →
CPA & tax firms
Encrypted laptops, MFA and device controls your IRS WISP relies on.
CPA firm cybersecurity →
Law & professional services
Client confidentiality on laptops and phones, lost-device exposure, personal phones.
Law firm cybersecurity →
MSP clients & partners
Independent validation of the tenant your MSP manages, with partner pricing.
Security audit for MSP clients →Findings mapped to the frameworks your auditors and insurers use
Each check maps to NIST CSF 2.0, ISO/IEC 27001:2022 Annex A, CIS Controls v8 and, where it applies, the CIS Microsoft Intune for Windows benchmark.
Three audits, one Microsoft cloud
Microsoft 365 security audit
Identity and MFA, admin access, Exchange and Defender, SPF/DKIM/DMARC, SharePoint and Teams sharing, Purview, audit logging. Devices are covered at a high level.
Microsoft Entra ID security audit
Identity in depth: 72 checks on sign-in, MFA, admin roles, Conditional Access, app consent and guests, plus 30 days of sign-in logs read for attacks.
Microsoft Intune security audit
The device side in depth: 127 checks on compliance, encryption, Defender, updates, apps, app protection, connectors and Intune admin access on every platform.
Every Intune audit is led by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure. Ali personally reviews every finding before it reaches your desk, and walks your leadership and IT team through the results.
He holds dozens of Microsoft and Cisco credentials (CCNP, CCNA, MCSE, MCITP, MCSA Security) and works on-site across Orange County, Los Angeles and Southern California, and remotely for organizations nationwide.
Not ready to talk? Get a first read for free.
Free tools give initial guidance only; they do not replace a professional audit.
Questions about the Intune audit
Scope, access, what your team will see and how it fits with the Microsoft 365 audit.
Implementation partner
OC Security Audit stays independent and read-only. If you want hands-on administration, IT Perfection can implement the fixes and support ongoing operations.
