# Windows 10 Or Later - Compliance Policy > This compliance policy ensures that Windows 10 and later devices meet organizational security standards. This compliance policy ensures that Windows 10 and later devices meet organizational security standards. It checks for device health, security settings, and compliance with required configurations, helping to protect corporate data and maintain a secure device environment. ## Settings this baseline controls | Setting | What it does | | ----------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------- | | Minimum Windows version | Minimum Windows 10 version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Maximum Windows version | Maximum Windows 10 version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Minimum Windows Phone version | Minimum Windows Phone version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Maximum Windows Phone version | Maximum Windows Phone version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Configuration Manager compliance required | Require device compliance with Configuration Manager. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Password required | Require a password to unlock Windows devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Block simple passwords | Block simple passwords. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Required password type | Type of characters in password. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | **17 more settings** | Setting | What it does | | -------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Minimum character set count | Number of character sets required in the password. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Minimum password length | Minimum password length. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Minutes before password required | Minutes of inactivity before a password is required. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Days until password expires | Number of days before the password expires. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Previous passwords remembered | Number of previous passwords to prevent reuse. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Password required after idle | Require a password when the device returns from an idle state. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Storage encryption required | Require encryption on Windows devices. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Firewall required | Require that a firewall is enabled on the device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Antivirus required | Require that anti-virus software is enabled on the device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Antispyware required | Require that anti-spyware software is enabled on the device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | TPM required | Require Trusted Platform Module (TPM) to be present. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Microsoft Defender enabled | Require that Windows Defender is enabled on the device. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Minimum Defender version | Require a specific Windows Defender version. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Security intelligence up-to-date | Require that Windows Defender signature is up to date. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Real-time protection enabled | Require that Windows Defender Real-Time Protection is enabled. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Mobile Threat Defense level | Required Mobile Threat Defense level. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | | Group assignments | The list of group assignments for this compliance policy. [Learn more](https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows) | [Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/) — Add, configure or remove a single baseline on a tenant, a user or a group, without deploying a whole scheme. ## Configure it Add this to a tenant that enrols Windows PCs, to set a floor of device health (a working TPM, disk encryption and active antivirus) before Windows can be trusted with your resources. 1. Add the baseline to the tenant directly ([Adding a baseline](https://docs.octiga.io/baselines/adding-a-baseline/)), or include it in a scheme you deploy to every tenant enrolling Windows devices ([Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)). 2. Leave **Password required** on: numeric, at least `6` characters, blocking simple passwords, expiring after `365` days, and required again after the device has been idle. 3. Leave **TPM required**, **Firewall required** and **Storage encryption required** (BitLocker) on. These three are the settings most likely to catch an older or misconfigured PC. 4. Leave **Antivirus required**, **Antispyware required**, **Real-time protection enabled** and **Security intelligence up-to-date** all on, but leave **Microsoft Defender enabled** off. The policy checks that some registered antivirus is active and current, rather than requiring Microsoft Defender specifically. 5. Set **Minimum Windows version** to `10.0.18363` (Windows 10, version 1909), leave the maximum blank, and leave **Configuration Manager compliance required** off unless this tenant co-manages devices with Configuration Manager. 6. Save, and turn on **Auto-remediation** if you want Octiga to correct this policy in Intune the next time it detects a deviation. > **Caution:** A PC that already fails these settings — no TPM, an unencrypted disk, or antivirus that's disabled or out of date — becomes noncompliant on its next check-in, and loses access to anything behind a Conditional Access device-compliance policy until it's brought up to standard. > **Licence: Intune:** ## Check it worked This baseline shows **Passing** once the policy exists in Intune with these settings and a Windows device reports back as compliant. Check progress in the Microsoft Intune admin centre: **Devices → Manage devices → Compliance → Policies**, open the policy, and use its device status and per-setting status views. A user on a noncompliant PC sees what needs fixing in the Company Portal app, and may lose access to protected resources until it's fixed. ## Standards this addresses ### CIS - **v8 4.1** — CIS Controls v8 Safeguard 4.1 - **v8 3.6** — CIS Controls v8 Safeguard 3.6 ### NIST - **PR.DS-1** — NIST CSF 2.0 PR.DS-1 - **SC-28** — NIST SP 800-53 SC-28 - **CM-6** — NIST SP 800-53 CM-6 ### ISO 27001 - **A.8.13** — ISO/IEC 27001:2022 Annex A.8.13 - **A.8.22** — ISO/IEC 27001:2022 Annex A.8.22 ### GDPR - **Article 32** — GDPR Article 32 **Doing this for every tenant?** Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time. [Deploying a scheme](https://docs.octiga.io/baselines/deploying-a-scheme/)