Intune
Intune’s seven baselines configure Microsoft Intune compliance and configuration policies across the platforms a tenant enrols (Windows, iOS/iPadOS, macOS and Android Enterprise). These policies decide whether a device meets minimum security standards before it’s trusted with company data.
Why it matters
A device is as much a way in as a password: an unencrypted laptop, a rooted phone, or a browser quietly saving passwords gives an attacker a foothold without any phishing. Left unmanaged, endpoints end up in every possible state, and a Conditional Access policy that requires a compliant device is only as strong as the compliance policy behind it. Three of these baselines aren’t about a device’s own posture: Windows LAPS rotates the local administrator password automatically, and the Chrome and Edge password-saving baselines close one of the simplest ways a stolen laptop becomes stolen credentials for everything else.
How Microsoft evaluates it
Intune has two mechanisms, and this category’s baselines use both. Compliance policies (the Android, iOS/iPadOS, macOS and Windows 10+ baselines) are platform-specific rules, such as password strength, encryption, OS version and integrity checks, that a device is evaluated against at every check-in. The result is a compliant or noncompliant status that a Conditional Access policy can act on. Configuration policies (Windows LAPS and the Chrome and Edge password-saving baselines) push and enforce a setting directly on the device, with no compliance verdict involved. Both are deployed to a group of users or devices and re-evaluated on Intune’s normal check-in cycle, not instantly. (Microsoft Learn: Use compliance policies to set rules for devices you manage with Intune, Apply features and settings on your devices using device profiles)
What end users experience
When a device falls out of compliance, the Company Portal app shows the user the specific setting to fix. If a Conditional Access policy is paired with it, the device can lose access to company resources until it’s back in line. Configuration policies are quieter. Windows LAPS is invisible to users, because it only touches a local administrator account they don’t sign in with day to day. Blocking password saving in Chrome or Edge removes the “save password” prompt and option the next time they sign in to a site, with no error or explanation.
| Baseline | Scope | Licence |
|---|---|---|
| Android Enterprise - Compliance Policy | Tenant | Intune |
| iOS/iPadOS - Compliance Policy | Tenant | Intune |
| MAC OS - Compliance Policy | Tenant | Intune |
| Windows 10 Or Later - Compliance Policy | Tenant | Intune |
| Windows 10 or later Configuration Policy - Block Password Saving In Google Chrome | Tenant | Intune |
| Windows 10 or later Configuration Policy - Block Password Saving In Microsoft Edge | Tenant | Intune |
| Windows 10 or later Configuration Policy - Windows LAPS Policy | Tenant | Intune |