Intune vs the CIS Windows 11 Benchmark: Running a Gap Analysis Before an Audit

The short version: An Intune vs CIS gap analysis compares what your Intune policies actually set on Windows 11 with each recommendation in the CIS benchmark you have chosen, usually the CIS Microsoft Intune for Windows 11 Benchmark (v5.0.0 is the current release as of November 2026). The Intune security baseline is Microsoft's own recommendation and is not the same document. The result is a register: matched, deliberately different (with a reason), not set, or not enforceable through Intune. Do it before an audit, so every difference is a recorded decision rather than a finding.

Sooner or later a client questionnaire, a cyber-insurance form or an auditor asks whether your Windows devices are "hardened to CIS". If you use Intune and assigned Microsoft's Windows security baseline, the tempting answer is yes. It is not quite right. The baseline and the CIS benchmark overlap heavily, but they are separate documents written by different organisations, and a device that matches one can fail items in the other.

An Intune vs CIS gap analysis is how you find out where they differ on your own devices. This guide explains which CIS document to compare against, how to build the comparison, which kinds of recommendation Intune can and cannot enforce directly, and how to present exceptions so they read as decisions. It builds on our article on auditing the Intune security baseline for drift, which covers whether the baseline you deployed is still the one your devices run.

Is the Intune security baseline the same as CIS?

No. Microsoft's Windows security baseline in Intune is Microsoft's recommended configuration, published as a set of default values per baseline version. The Center for Internet Security writes its benchmarks through a separate consensus process. The two agree on most of the big-ticket items (Defender on, firewall on, BitLocker, no legacy protocols), but they differ in scope, in specific values and in how many settings they cover. Some CIS recommendations are stricter than Microsoft's default, some settings appear in one and not the other, and CIS splits its recommendations into profiles such as Level 1 and Level 2 where Microsoft has one recommended value.

So "we deployed the Intune baseline" is a good starting point, but it is not evidence of CIS alignment. If someone asks about CIS, the honest answer comes from a comparison.

Which CIS Windows 11 benchmark should you compare against?

CIS publishes two Windows 11 benchmarks, and picking the wrong one is the first common mistake.

• CIS Microsoft Intune for Windows 11 Benchmark. Written for devices managed through Intune, with each recommendation expressed as an MDM or settings catalog setting. CIS announced v5.0.0 in its July 2026 benchmark update. For Intune-managed devices, this is normally the one to use.
• CIS Microsoft Windows 11 Enterprise Benchmark. Written around Group Policy. Its most recent release at the time of writing is v5.1.0, announced in CIS's September 2026 update. It suits domain-joined estates managed by GPO, or hybrid estates where Group Policy still owns many settings.

Whichever you choose, write the benchmark name, version and profile at the top of the analysis. "CIS Level 1" without a version is not a reference anyone can check, and benchmark versions change recommendations between releases. If your last analysis was against an older Intune benchmark version, treat moving to the new version as a fresh comparison rather than an update.

Intune security baseline vs CIS Intune benchmark vs CIS Windows 11 Enterprise

How the three compare

• Author: the Intune baseline is written by Microsoft; both CIS benchmarks are written by the Center for Internet Security.
• Delivery: the baseline is a ready-made Intune profile you assign; the CIS Intune benchmark is a document you implement through Intune policies; the Enterprise benchmark is a document written around Group Policy.
• Profiles: the baseline has one recommended value per setting that you can customise; the CIS benchmarks separate recommendations into profiles such as Level 1 and Level 2.
• Versioning: baseline versions follow Windows releases and an existing profile stays on its version until you update it; CIS benchmark versions are released on CIS's own schedule.
• Best used as: the baseline is a fast, supported starting configuration; the CIS Intune benchmark is the reference when someone asks for CIS on Intune-managed devices; the Enterprise benchmark is the reference for GPO-managed estates.
• What it proves on its own: the baseline proves you assigned Microsoft's recommendation; a CIS benchmark proves nothing until you compare your devices with it.

How do you run an Intune vs CIS gap analysis?

You can run a first pass yourself for a small estate. Allow a few days, most of it spent on mapping.

1. Fix the reference. Choose the benchmark, version and profile (for most small organisations, Level 1 of the CIS Intune for Windows 11 benchmark). Record which recommendations you consider in scope; some only apply to particular device types or features.
2. Inventory what sets each setting. List every Intune policy that targets Windows devices: security baselines, settings catalog profiles, endpoint security policies (antivirus, firewall, disk encryption, attack surface reduction, account protection) and any older device configuration profiles. A setting can be set in several places, and you need to know all of them.
3. Map each recommendation to its source. For each CIS recommendation, record which policy sets it, the configured value and the expected value. Use a spreadsheet with one row per recommendation; it becomes your evidence.
4. Check what the devices report. The policy says what should apply; the per-setting status says what did. Use the per-setting report for each profile, and on a sample device export the management diagnostic report from Settings, Accounts, Access work or school. Conflicts and errors belong in the register, not only the configured value.
5. Classify every row. Use a small, fixed set of outcomes: matches; differs deliberately (with a reason and an owner); not set; set but in conflict or error; not enforceable through Intune (with how it is covered instead); not applicable.
6. Decide the order of fixes. Close "not set" rows that carry no business impact first; test anything that could affect users or line-of-business applications with a pilot group before assigning it widely.

Keep the spreadsheet. The next analysis, after a new benchmark version or a new baseline version, is a comparison against this one rather than a fresh start.

Which CIS recommendations can Intune enforce, and which can it not?

In practice the rows fall into three groups.

• Set directly in Intune. The majority. Most recommendations correspond to a settings catalog setting or a setting inside an endpoint security policy, and the CIS Intune benchmark is written to make that mapping straightforward.
• Set indirectly. Some recommendations need a custom configuration (an OMA-URI), a PowerShell script or a remediation script, or depend on a feature being licensed and switched on elsewhere. These work, but they are the rows most likely to be forgotten or to break silently when something changes, so record how each one is delivered and how you check it.
• Outside what device management sets. A minority describe conditions that are about process, hardware or a different system rather than a device setting. Cover those with a compliance check, a documented procedure or an explicit exception, and say so in the register.

Whatever the split on your estate, write it down per row. The point of the analysis is not a percentage score; it is that an auditor can pick any recommendation and see what you do about it.

Where do the differences usually show up?

Without quoting a count, these are the areas worth checking first, because they are often set by more than one policy, left at Windows defaults, or relaxed for a business reason nobody wrote down:

• Audit policy. CIS recommends specific advanced audit policy subcategories; if nobody configured them, Windows defaults apply and the device logs less than the benchmark expects.
• User rights assignments and local accounts. Who may log on locally, over Remote Desktop or as a service, and how the local administrator account is managed.
• Attack surface reduction rules. Whether each rule is in block mode or still in audit mode from a pilot.
• Remote Desktop and remote assistance settings. Often relaxed for support and never tightened again.
• Firewall logging and profile settings. Firewall on is common; the logging and per-profile settings CIS specifies are less so.
• Disk encryption details. BitLocker is usually on; the specific recovery, startup and encryption-method settings are where differences appear.

None of these is a reason to change a setting without testing. They are where to look.

How should you record exceptions?

An exception is a recommendation you have decided not to follow, or to follow differently. Auditors do not expect zero exceptions; they expect each one to be a decision.

For each exception record the recommendation and benchmark version, the value you use instead, the reason (an application requirement, a support need, a user impact you tested), any compensating control, the person who approved it and a review date. Avoid "temporary" exceptions with no date; a year later nobody can say whether the reason still holds.

Do not resolve a conflict by excluding devices from the policy that sets the CIS value. That turns a visible conflict into an invisible coverage gap, the same trap our baseline drift guide describes.

What does an independent audit add?

A self-run analysis is worth doing, but it has two weaknesses: the person mapping the settings usually configured them, and nobody checks the devices that are not in Intune at all. An independent device audit compares every enrolled device with the benchmark you name, counts the devices that should be enrolled and are not, and hands you a findings register and workbook designed to be used as evidence. Our sample Intune device audit report shows the format, and the device audit is scoped together with the Microsoft 365 security audit, where the current pricing is listed.

If the gap analysis shows you are missing a capability rather than a setting, check what your licence includes before buying anything. Our Microsoft Intune pricing page explains what each plan covers.

Frequently asked questions

Does assigning the Intune security baseline make our devices CIS compliant?

No. The baseline is Microsoft's recommendation and overlaps with CIS without being the same. To say anything about CIS you need a comparison against a named CIS benchmark version.

Should we use the CIS Intune benchmark or the Windows 11 Enterprise benchmark?

For devices managed through Intune, the CIS Microsoft Intune for Windows 11 Benchmark, because its recommendations are written as Intune settings. Use the Enterprise benchmark for estates managed mainly through Group Policy.

Can we apply Level 2 to every device?

You can, but test first. Level 2 recommendations are stricter and some affect usability or application compatibility. Many organisations apply Level 1 widely and Level 2 to specific groups, such as administrators' devices.

Is there a tool that does the comparison automatically?

Several tools can scan a device against a CIS benchmark, and CIS offers its own assessment tooling to members. They are useful for the device check. They do not tell you why a setting differs or who decided it, which is what an auditor asks next, so you still need the register.

How often should we repeat the gap analysis?

When CIS releases a new version of the benchmark you follow, when you move to a new Intune baseline version, and at least once a year. Each time, compare against the previous register rather than starting from scratch.

Will fixing the gaps break anything?

Some recommendations can affect users or older applications. Assign changes to a pilot group first, watch for errors and help-desk tickets for a week or two, then widen the assignment.

Next step

If an auditor or client has asked about CIS on your Windows devices and you would rather not build the register alone, talk to a consultant. We can run the device audit against the CIS version you name and leave you with the register and the evidence.