| 4.4.5 Ensure 'WDigest Authentication' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.9 Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.5.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.7.7 Ensure 'Configure RPC over TCP port: RPC over TCP port:' is set to 'Enabled: 0' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.7.8 Ensure 'Limits print driver installation to Administrators' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.10.4.1 Ensure 'Include command line in process creation events' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.10.26.1 Ensure 'Block user from showing account details on sign-in' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT, SYSTEM AND SERVICES ACQUISITION |
| 4.10.26.5 Ensure 'Turn off app notifications on the lock screen' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.29.5.1 Ensure 'Require a password when a computer wakes (on battery)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.10.29.5.2 Ensure 'Require a password when a computer wakes (plugged in)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.10.31.1 Ensure 'Enable RPC Endpoint Mapper Client Authentication' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.10.44.1.1 Ensure 'Enable Windows NTP Client' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.3.1 Ensure 'Allow Microsoft accounts to be optional' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.11.8.3 Ensure 'Prevent the use of security questions for local accounts' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.10.2 Ensure 'Enable App Installer Hash Override' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.11.15.2.2 Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 196,608 or greater' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.15.3.2 Ensure 'Specify the maximum log file size (KB)' is set to 'Enabled: 32,768 or greater' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.11.18.1 Ensure 'Configure Windows Defender SmartScreen' is set to 'Enabled: Warn and prevent bypass' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.11.27.1 Ensure 'Block all consumer Microsoft account user authentication' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 4.11.35.3.2 Ensure 'Do not allow passwords to be saved' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 4.11.35.4.3.2 Ensure 'Do not allow drive redirection' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 6.6 Ensure 'Account Management Audit Application Group Management' is set to 'Success and Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.19 Ensure 'Object Access Audit Other Object Access Events' is set to 'Success and Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 37.5 Ensure 'Enable Domain Network Firewall: Enable Log Success Connections' is set to 'Enable Logging Of Successful Connections' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 37.7 Ensure 'Enable Domain Network Firewall: Log Max File Size' is set to '16,384 KB or greater' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 45.4 Ensure 'Auth Rate Limiter Delay In Ms' is set to '2000' or higher | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 46.4 Ensure 'Enable insecure guest logons' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 46.7 Ensure 'Require Encryption' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.8 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.10 Configure 'Interactive logon: Message title for users attempting to log on' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.14 Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.22 Ensure 'Network Security Minimum Session Security For NTLMSSP Based Clients' is set to 'Require NTLM and 128-bit encryption' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.30 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 69.4 Ensure 'Let Apps Activate With Voice Above Lock' is set to 'Enabled: Force Deny' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.11 Ensure 'Microsoft FTP Service (FTPSVC)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.33 Ensure 'Windows Mobile Hotspot Service (icssvc)' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 90.8 Ensure 'Create Page File' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.9 Ensure 'Create Permanent Shared Objects' is set to 'No One' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.11 Ensure 'Create Token' is set to 'No One' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.13 Ensure 'Deny Access From Network' to include 'Guests, Local account' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.15 Ensure 'Deny Log On As Batch Job' to include 'Guests' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.18 Ensure 'Enable Delegation' is set to 'No One' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.19 Ensure 'Generate Security Audits' is set to 'LOCAL SERVICE, NETWORK SERVICE, RESTRICTED SERVICES\PrintSpoolerService' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.22 Ensure 'Load Unload Device Drivers' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.23 Ensure 'Lock Memory' is set to 'No One' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.26 Ensure 'Manage Volume' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 98.3 Ensure 'Minimum PIN Length' is set to '6 more character(s)' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
| 104.1 Ensure 'Allow Auto Update' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 104.2 Ensure 'Defer Feature Updates Period in Days' is set to 'Enabled: 180 or more days' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 104.4 Ensure 'Scheduled Install Day' is set to 'Every day' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
