Severity tells you what to fix first
Each check is rated by the damage a gap could cause. In the audit, every check gets a result: Pass, Partial, Gap, Manual review, Informational or Not assessed. The security score weights Critical checks 4, High 3, Medium 2 and Low 1.
Scores of 85 or more are rated Good, 70-84 Fair, 50-69 Needs improvement and below 50 Poor. See how results appear in the sample report →
Severity levels
1. Tenant & Service Configuration (10 checks)
Tenant-wide settings that decide how Intune treats every device, including what happens to devices with no compliance policy.
TEN-01Intune subscription is active and MDM authority is IntuneCriticalTEN-02Devices with no compliance policy are treated as not compliantHighTEN-03Compliance status validity period is 30 days or lessMediumTEN-05Android device administrator enrollment is disabledMediumTEN-06Device clean-up rule retires stale devicesMediumTEN-04Enhanced jailbreak detection is enabledLowTEN-07Company Portal branding and support contact are configuredLowTEN-08Assignment filters are used to scope policiesLowTEN-09Endpoint analytics and diagnostics features are enabledLowTEN-10Licensing supports the security features in useInfo2. Enrollment & Windows Autopilot (10 checks)
Who can enroll which devices, personal-device rules, Autopilot profiles and Windows Hello for Business.
ENR-01Personal (BYOD) Windows enrollment is blocked unless intendedHighENR-05Windows Hello for Business is enabled with TPM and a strong PINHighENR-08MDM user scope and MFA for device registration are configuredHighENR-02Personal Android and iOS enrollment is restricted or covered by app protectionMediumENR-03Minimum OS versions are enforced at enrollmentMediumENR-06Enrollment Status Page blocks device use until required apps installMediumENR-07Autopilot profiles deploy standard users and hide privacy/EULA promptsMediumENR-04Device enrollment limit per user is reasonableLowENR-09Windows Autopilot device sync is healthyLowENR-10Co-management authority and Configuration Manager integration are deliberateInfo3. Device Compliance (10 checks)
Whether every platform has a compliance policy, what it requires, and what happens when a device falls out of compliance.
CMP-01A compliance policy exists and is assigned for every enrolled platformCriticalCMP-02Windows compliance requires BitLocker, Secure Boot and code integrityHighCMP-03Windows compliance requires Defender antivirus, real-time protection and firewallHighCMP-06Mobile compliance blocks jailbroken/rooted devices and requires a passcode and encryptionHighCMP-09Device compliance rate is 90% or betterHighCMP-04Windows compliance enforces a minimum OS version and password/lock settingsMediumCMP-05Windows compliance uses Defender for Endpoint machine risk scoreMediumCMP-07macOS compliance requires FileVault, firewall, SIP and GatekeeperMediumCMP-08Non-compliance actions notify users and block within a short grace periodMediumCMP-10No user is left with only non-compliant devicesMedium4. Device Configuration (11 checks)
Configuration profiles, assignment scope, conflicts, Edge and SmartScreen, removable media and assignment groups.
CFG-04Device configuration policies report low error and conflict ratesMediumCFG-05A device-lock / password policy is applied to Windows devicesMediumCFG-07Microsoft Edge / SmartScreen protections are enforcedMediumGRP-01Assignment groups are not emptyMediumGRP-02Dynamic assignment groups process without errorsMediumCFG-01No unassigned (orphaned) policiesLowCFG-02Legacy device configuration profiles migrated to Settings catalog / Endpoint securityLowCFG-03Policies assigned to All devices / All users use assignment filtersLowCFG-08Removable storage and untrusted USB devices are controlledLowGRP-03Assignment groups are security groups with clear ownership (no nested surprises)LowCFG-06Administrative templates and custom OMA-URI profiles are documentedInfo5. Endpoint Security (25 checks)
Defender Antivirus, tamper protection, ASR rules, firewall, BitLocker, LAPS, Credential Guard and CIS-aligned hardening.
SEC-01A Microsoft Defender Antivirus policy is assigned to Windows devicesCriticalSEC-02Real-time protection is enforcedCriticalSEC-10BitLocker full-disk encryption is enforced with recovery keys escrowed to Entra IDCriticalBAS-01Windows configuration meets the CIS-aligned key hardening settingsHighSEC-03Cloud-delivered protection at High or higherHighSEC-05Behavior monitoring is enabledHighSEC-07Tamper protection is enabledHighSEC-08Attack surface reduction rules are deployed in block modeHighSEC-09Windows Firewall is enabled for domain, private and public profilesHighSEC-11Defender for Endpoint (EDR) onboarding policy is deployedHighSEC-12Windows LAPS manages the local administrator passwordHighSEC-13Credential Guard and LSA protection are enabledHighSEC-15Local administrator group membership is controlledHighSEC-19No unresolved high-severity security alerts on managed devicesHighBAS-03macOS configuration meets the CIS-aligned key hardening settingsMediumBAS-04iOS/iPadOS configuration meets the key hardening settingsMediumBAS-05Android Enterprise configuration meets the key hardening settingsMediumSEC-04Potentially unwanted application (PUA) protection is in block modeMediumSEC-06Network protection is in block modeMediumSEC-14Microsoft security baselines are deployed and currentMediumSEC-17macOS endpoint security: FileVault, firewall and Gatekeeper enforcedMediumSEC-18Devices report no active malware and healthy Defender stateMediumSEC-20Microsoft Secure Score device and app recommendations are implementedMediumBAS-02Deployed security baselines are unchanged from Microsoft defaults (or changes are documented)LowSEC-16Application control (WDAC / Smart App Control) or at least Store restrictionsLow6. Update Management (6 checks)
Update rings, feature and driver updates, expedited patches, current builds and Windows 11 readiness.
UPD-01Windows Update rings are assigned with deadlines and short deferralsHighUPD-02Windows feature update policy keeps devices on a supported versionHighUPD-05Managed devices run current OS buildsMediumUPD-06Windows 10 devices are assessed for Windows 11 upgrade eligibilityMediumUPD-03Driver updates are managed (automatic or manual approval)LowUPD-04Expedited quality updates are available for emergenciesLowNot sure where you stand?
Answer 15 questions and get an instant score for your Intune tenant.
Take the free Intune self-check7. Application Management (5 checks)
Required apps, failed and orphaned packages, Store access and end-of-life or high-risk software.
APP-05No end-of-life, vulnerable or high-risk applications on managed devicesHighAPP-01Required security and productivity apps are deployedMediumAPP-02Unassigned and failed app packages are cleaned upLowAPP-03Microsoft Store / marketplace access is controlledLowAPP-04Win32 apps are deployed with detection rules and requirementsInfo8. App Protection (MAM) (5 checks)
Mobile app protection: PINs, copy/paste and save-as restrictions, and device conditions for company data.
MAM-01App protection policies exist for iOS and AndroidHighMAM-03App protection restricts data transfer, backup, save-as and clipboardHighMAM-02App protection requires a PIN, blocks simple PINs and wipes after retriesMediumMAM-04App protection enforces device conditions (jailbreak, min OS, device compliance)MediumMAM-05Windows app protection (Edge MAM) or WIP covers unmanaged Windows accessInfo9. Device Inventory & Hygiene (8 checks)
Stale devices, jailbroken or rooted devices, personal devices, Entra join state and unmanaged sign-ins.
DEV-02No jailbroken or rooted devices are enrolledHighDEV-01Stale managed devices are removedMediumDEV-04Entra devices are managed and compliantMediumDEV-07Every active user works from a managed device (shadow-IT signal)MediumDEV-03Personal devices are only enrolled where a BYOD program existsLowDEV-05Windows devices are Entra joined (not registered) and Autopilot-enrolledLowDEV-08Hardware fleet is healthy (battery, startup performance, crashes)LowDEV-06Device categories and naming standards are in useInfo10. Identity & Conditional Access (5 checks)
Whether Conditional Access actually enforces device compliance, MFA, app protection and blocks legacy sign-in.
IDN-01Conditional Access requires a compliant device for corporate resourcesCriticalIDN-02Conditional Access requires MFA for all users and for device enrollmentCriticalIDN-03Conditional Access requires approved apps / app protection on mobileHighIDN-04Legacy authentication is blocked by Conditional AccessHighIDN-05Intune administrators are protected by MFA/device requirementsHigh11. Administration & RBAC (8 checks)
Global Administrators, just-in-time (PIM) access, MFA for admins, dormant admins and scoped Intune roles.
PRV-02All administrators are registered for MFA (phishing-resistant preferred)CriticalPRV-01Privileged roles use PIM eligible (just-in-time) assignmentsHighRBC-01Global Administrator role is limited to 2-4 accountsHighPRV-03Privileged accounts are actively used (no dormant admins)MediumPRV-04Intune RBAC assignments grant only the permissions operators needMediumRBC-02Intune administration uses scoped roles rather than Global AdministratorMediumRBC-04Administrator accounts are cloud-only, enabled and in useMediumRBC-03Scope tags separate administrative boundaries where neededLow12. Connectors & Integrations (8 checks)
Defender for Endpoint connector, Apple push certificate, VPP and enrollment tokens, Managed Google Play and certificate connectors.
CON-02Apple MDM push certificate is valid and not close to expiryCriticalCON-01Microsoft Defender for Endpoint connector is enabled for all platformsHighCON-03Apple VPP and Automated Device Enrollment tokens are valid and syncingHighCON-08No certificate, token or connector expires within 90 daysHighCON-04Managed Google Play is connected for Android EnterpriseMediumCON-05Certificate connectors (NDES/PKCS) are active and currentMediumCON-06Third-party partner connectors are healthy or removedLowCON-07Windows data sharing / diagnostic consents are deliberateInfo13. Scripts & Remediations (3 checks)
PowerShell and shell scripts: embedded passwords or secrets, signing and remediation scripts.
SCR-01Deployed scripts contain no embedded credentials or secretsCriticalSCR-02Scripts run with signature checks or from a controlled processLowSCR-03Proactive remediations are used for security hygieneInfo14. Monitoring & Audit (4 checks)
Audit log review, remote wipe and retire actions, alert rules and enrollment terms.
AUD-01Intune audit log is active and reviewedMediumAUD-02Remote actions (wipe, retire, reset) are limited and reviewedLowAUD-03Intune alert rules are configuredLowAUD-04Terms and conditions are presented at enrollmentInfo15. Policy Application Status (9 checks)
Whether policies, scripts and apps actually apply on devices without errors or conflicts.
STA-01Compliance policies evaluate without errors or conflictsHighSTA-02Configuration profiles apply without errors or conflictsMediumSTA-03Endpoint security (legacy template) policies apply without errorsMediumSTA-06Required applications install successfullyMediumSTA-09App protection: no flagged (rooted/jailbroken) app registrationsMediumSTA-04PowerShell scripts run successfully on targeted devicesLowSTA-05Remediation scripts detect and remediate without errorsLowSTA-07Windows Autopilot deployments succeedLowSTA-08Compliance settings that fail most often are knownInfoHave us run all 127 checks for you
A CISO-led, read-only audit with evidence for every finding, business risks, a 180-day roadmap and a readout meeting. $3,500 fixed.
Mapped to your frameworks
Each check maps to NIST CSF 2.0, ISO/IEC 27001:2022, CIS Controls v8 and, where it applies, the CIS Microsoft Intune for Windows benchmark.
About the checklist
How to use the 127 checks and when to bring in an auditor.
Every Intune audit is led by Ali Hassani, CISO
Certified CISO (C|CISO) and CISSP with 25+ years in IT, cybersecurity, compliance and infrastructure. Ali personally reviews every finding before it reaches your desk, and walks your leadership and IT team through the results.
He holds dozens of Microsoft and Cisco credentials (CCNP, CCNA, MCSE, MCITP, MCSA Security) and works on-site across Orange County, Los Angeles and Southern California, and remotely for organizations nationwide.
