| 1.2 Ensure 'Allow Toasts' is set to 'Block' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.4.5 Ensure 'WDigest Authentication' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 4.5.9 Ensure 'MSS: (SafeDllSearchMode) Enable Safe DLL search mode (recommended)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.5.12 Ensure 'MSS: (WarningLevel) Percentage threshold for the security event log at which the system will generate a warning' is set to 'Enabled: 90% or less' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 4.7.7 Ensure 'Configure RPC over TCP port: RPC over TCP port:' is set to 'Enabled: 0' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 4.7.8 Ensure 'Limits print driver installation to Administrators' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 4.11.8.3 Ensure 'Prevent the use of security questions for local accounts' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 6.2 Ensure 'Account Logon Logoff Audit Account Lockout' is set to include 'Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.3 Ensure 'Account Logon Logoff Audit Group Membership' is set to include 'Success' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.12 Ensure 'Audit Security Group Management' is set to include 'Success' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.23 Ensure 'Privilege Use Audit Sensitive Privilege Use' is set to 'Success' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 6.27 Ensure 'System Audit System Integrity' is set to 'Success and Failure' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 22.1 Ensure 'DO Download Mode' is NOT set to 'HTTP blended with Internet Peering' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | RISK ASSESSMENT, SYSTEM AND INFORMATION INTEGRITY |
| 33.5 Ensure 'Do not show feedback notifications' is set to 'Feedback notifications are disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 37.4 Ensure 'Enable Domain Network Firewall: Enable Log Dropped Packets' is set to 'Yes: Enable Logging Of Dropped Packets' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY, SYSTEM AND COMMUNICATIONS PROTECTION |
| 37.6 Ensure 'Enable Domain Network Firewall: Log File Path' is configured | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 37.8 Ensure 'Enable Private Network Firewall' is set to 'True' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 37.9 Ensure 'Enable Private Network Firewall: Default Inbound Action for Private Profile' is set to 'Block' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 37.15 Ensure 'Enable Public Network Firewall' is set to 'True' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 37.19 Ensure 'Enable Public Network Firewall: Disable Inbound Notifications' is set to 'True' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 45.4 Ensure 'Auth Rate Limiter Delay In Ms' is set to '2000' or higher | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 46.4 Ensure 'Enable insecure guest logons' is set to 'Disabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 46.7 Ensure 'Require Encryption' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.8 Ensure 'Interactive logon: Machine inactivity limit' is set to '900 or fewer second(s), but not 0' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.9 Configure 'Interactive logon: Message text for users attempting to log on' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.10 Configure 'Interactive logon: Message title for users attempting to log on' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 49.14 Ensure 'Microsoft network server: Digitally sign communications (always)' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.22 Ensure 'Network Security Minimum Session Security For NTLMSSP Based Clients' is set to 'Require NTLM and 128-bit encryption' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, IDENTIFICATION AND AUTHENTICATION, SYSTEM AND COMMUNICATIONS PROTECTION |
| 49.30 Ensure 'User Account Control: Switch to the secure desktop when prompting for elevation' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL |
| 50.1 Ensure 'Configure Lsa Protected Process' is set to 'Enabled with UEFI Lock...' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 73.3 Ensure 'Allow Search To Use Location' is set to 'Block' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 77.1.2 Ensure 'Notify Password Reuse' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 81.6 Ensure 'Enable OneSettings Auditing' is set to 'Enabled' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | AUDIT AND ACCOUNTABILITY |
| 82.7 Ensure 'IIS Admin Service (IISADMIN)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.8 Ensure 'Infrared monitor service (irmon)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 82.10 Ensure 'LxssManager (LxssManager)' is set to 'Disabled' or 'Not Installed' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | CONFIGURATION MANAGEMENT |
| 90.1 Ensure 'Access Credential Manager As Trusted Caller' is set to 'No One' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.5 Ensure 'Backup Files And Directories' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.6 Ensure 'Change System Time' is set to 'Administrators, LOCAL SERVICE' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.20 Ensure 'Impersonate Client' is set to 'Administrators, LOCAL SERVICE, NETWORK SERVICE, SERVICE, RESTRICTED SERVICES\PrintSpoolerService' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.28 Ensure 'Modify Object Label' is set to 'No One' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.29 Ensure 'Profile Single Process' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.30 Ensure 'Profile System Performance' is set to 'Administrators, NT SERVICE\WdiServiceHost' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 90.31 Ensure 'Remote Shutdown' is set to 'Administrators' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | ACCESS CONTROL, AUDIT AND ACCOUNTABILITY |
| 98.2 Ensure 'Facial Features Use Enhanced Anti Spoofing' is set to 'true' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION, SYSTEM AND INFORMATION INTEGRITY |
| 106.1.2 Ensure 'Device Health: Secure Boot' is set to 'Require' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 106.1.3 Ensure 'Device Health: Code integrity' is set to 'Require' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 106.2.1.1 Ensure 'System Security: Device Security: Firewall' is set to 'Require' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND COMMUNICATIONS PROTECTION |
| 106.2.1.4 Ensure 'System Security: Device Security: Antispyware' is set to 'Require' | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | SYSTEM AND INFORMATION INTEGRITY |
| 107.3 Ensure 'Password Complexity' is set to 'Large letters + small letters + numbers + special characters' or higher | CIS Microsoft Intune for Windows 11 v5.0.0 L1 | Windows | IDENTIFICATION AND AUTHENTICATION |
