Windows 10 Or Later - Compliance Policy
This compliance policy ensures that Windows 10 and later devices meet organizational security standards. It checks for device health, security settings, and compliance with required configurations, helping to protect corporate data and maintain a secure device environment.
Settings this baseline controls
| Setting | What it does |
|---|---|
| Minimum Windows version | Minimum Windows 10 version. Learn more |
| Maximum Windows version | Maximum Windows 10 version. Learn more |
| Minimum Windows Phone version | Minimum Windows Phone version. Learn more |
| Maximum Windows Phone version | Maximum Windows Phone version. Learn more |
| Configuration Manager compliance required | Require device compliance with Configuration Manager. Learn more |
| Password required | Require a password to unlock Windows devices. Learn more |
| Block simple passwords | Block simple passwords. Learn more |
| Required password type | Type of characters in password. Learn more |
17 more settings
| Setting | What it does |
|---|---|
| Minimum character set count | Number of character sets required in the password. Learn more |
| Minimum password length | Minimum password length. Learn more |
| Minutes before password required | Minutes of inactivity before a password is required. Learn more |
| Days until password expires | Number of days before the password expires. Learn more |
| Previous passwords remembered | Number of previous passwords to prevent reuse. Learn more |
| Password required after idle | Require a password when the device returns from an idle state. Learn more |
| Storage encryption required | Require encryption on Windows devices. Learn more |
| Firewall required | Require that a firewall is enabled on the device. Learn more |
| Antivirus required | Require that anti-virus software is enabled on the device. Learn more |
| Antispyware required | Require that anti-spyware software is enabled on the device. Learn more |
| TPM required | Require Trusted Platform Module (TPM) to be present. Learn more |
| Microsoft Defender enabled | Require that Windows Defender is enabled on the device. Learn more |
| Minimum Defender version | Require a specific Windows Defender version. Learn more |
| Security intelligence up-to-date | Require that Windows Defender signature is up to date. Learn more |
| Real-time protection enabled | Require that Windows Defender Real-Time Protection is enabled. Learn more |
| Mobile Threat Defense level | Required Mobile Threat Defense level. Learn more |
| Group assignments | The list of group assignments for this compliance policy. Learn more |
Configure it
Add this to a tenant that enrols Windows PCs, to set a floor of device health (a working TPM, disk encryption and active antivirus) before Windows can be trusted with your resources.
-
Add the baseline to the tenant directly (Adding a baseline), or include it in a scheme you deploy to every tenant enrolling Windows devices (Deploying a scheme).
-
Leave Password required on: numeric, at least
6characters, blocking simple passwords, expiring after365days, and required again after the device has been idle. -
Leave TPM required, Firewall required and Storage encryption required (BitLocker) on. These three are the settings most likely to catch an older or misconfigured PC.
-
Leave Antivirus required, Antispyware required, Real-time protection enabled and Security intelligence up-to-date all on, but leave Microsoft Defender enabled off. The policy checks that some registered antivirus is active and current, rather than requiring Microsoft Defender specifically.
-
Set Minimum Windows version to
10.0.18363(Windows 10, version 1909), leave the maximum blank, and leave Configuration Manager compliance required off unless this tenant co-manages devices with Configuration Manager. -
Save, and turn on Auto-remediation if you want Octiga to correct this policy in Intune the next time it detects a deviation.
Check it worked
This baseline shows Passing once the policy exists in Intune with these settings and a Windows device reports back as compliant. Check progress in the Microsoft Intune admin centre: Devices → Manage devices → Compliance → Policies, open the policy, and use its device status and per-setting status views. A user on a noncompliant PC sees what needs fixing in the Company Portal app, and may lose access to protected resources until it’s fixed.
Standards this addresses
Doing this for every tenant?
Step through the deploy wizard to apply a scheme to a tenant, groups or users, and see what Managed and Direct do at deploy time.