🎯 Objective of Day-11
By the end of Day-11, you will be able to:
- Explain what Intune Security Baselines are
- Deploy baselines safely
- Understand Defender for Endpoint integration
- See how device risk affects access decisions
1️⃣ What Are Security Baselines?
Security Baselines are Microsoft-recommended security configurations that:
- Apply industry best practices
- Reduce attack surface
- Standardize device security
📌 Think of baselines as secure starting points, not final tuning.
2️⃣ Security Baseline vs Compliance vs Configuration
| Feature | Purpose | Enforces | Evaluates |
|---|---|---|---|
| Security Baseline | Best-practice security | ✅ Yes | ❌ No |
| Configuration Profile | Custom settings | ✅ Yes | ❌ No |
| Compliance Policy | Trust decision | ❌ No | ✅ Yes |
📌 Baselines enforce, compliance decides.
3️⃣ Available Security Baselines in Intune
Common baselines:
- Windows Security Baseline
- Microsoft Defender for Endpoint Baseline
- Microsoft Edge Baseline
Each baseline targets a specific security layer.
4️⃣ Where to Configure Security Baselines
Steps:
- Intune Admin Center
- Endpoint security
- Security baselines
- Select baseline (e.g., Windows)
- Create profile
5️⃣ Deploying a Security Baseline (Safely)
Best practice steps:
- Create baseline profile
- Assign to pilot group first
- Review conflicts
- Monitor impact
- Expand gradually
📌 Never assign baselines to All devices on Day-1.
6️⃣ Common Settings Applied by Baselines
- Credential Guard
- Defender Antivirus
- Firewall enforcement
- Attack Surface Reduction (ASR) rules
- SmartScreen protection
📌 These settings actively change device behavior.
7️⃣ What Is Microsoft Defender for Endpoint (MDE)?
Defender for Endpoint is an Endpoint Detection & Response (EDR) solution that:
- Detects threats
- Assesses device risk
- Reports vulnerabilities
- Feeds risk data to Conditional Access
8️⃣ How Intune & Defender for Endpoint Work Together
Flow:
Device → Defender detects risk
→ Risk score updated
→ Intune receives status
→ Conditional Access evaluates access
📌 Defender does not block access — CA does.
9️⃣ Enable Defender for Endpoint Integration
Steps:
- Intune → Tenant administration
- Connectors and tokens
- Microsoft Defender for Endpoint
- Enable connection
🔟 Device Risk Levels (Important)
Defender assigns risk:
- Low
- Medium
- High
These can be used in Conditional Access policies.
1️⃣1️⃣ Real-World Scenario
Situation:
User device is compliant but infected.
What happens:
- Defender flags device as High risk
- CA policy blocks access
- Admin remediates device
- Access restored automatically
📌 This is risk-based security in action.
1️⃣2️⃣ Common Admin Mistakes
❌ Enabling baselines without pilot testing
❌ Conflicting baseline + configuration profiles
❌ Ignoring Defender alerts
❌ No CA policy tied to device risk
1️⃣3️⃣ Best Practices Checklist
✔ Pilot first
✔ Monitor conflicts
✔ Align Defender + CA
✔ Document changes
✔ Review monthly
✅ End of Day-11 Outcome
You can now:
✔ Explain security baselines confidently
✔ Deploy them safely
✔ Understand Defender integration
✔ Design stronger security posture
🔜 Day-12 Preview
Day-12: Risk-Based Conditional Access
- Device risk vs sign-in risk
- Defender-driven access blocking
- Real incident response flow
- Admin troubleshooting scenarios