Intune security baselines, settings catalog, GPO conflicts

For cloud-managed and co-managed devices, Intune security baselines are the MDM counterpart of the Group Policy baselines described in the security baselines pillar. They are quick to deploy, which is also their risk: a baseline assigned next to endpoint security policies, settings catalog profiles and inherited GPOs can produce conflicts that leave the most important settings not applied at all.

This guide covers how to deploy the baselines as one clean layer, where to put your own settings, how Group Policy and MDM interact on hybrid devices, and how to check what really applied.

What Intune offers

Under Endpoint security > Security baselines, Intune provides several baselines, each versioned:

Recent baseline versions are built on the settings catalog format, so each setting in a baseline is the same object you would configure in a settings catalog profile. That makes per-setting reporting and comparison much easier than with the older template-based versions.

Step 1: map what you already have

Before assigning anything to devices that already receive GPOs, measure the overlap. Devices > Manage devices > Group Policy analytics imports GPO XML reports and shows which settings have an MDM equivalent:

Get-GPOReport -Name "BL - Win11 24H2 - Computer" -ReportType Xml -Path C:\Temp\bl-computer.xml
Get-GPOReport -Name "Workstation Security" -ReportType Xml -Path C:\Temp\ws-security.xml

Upload the XML files, review the MDM support column, and use the migration option to create settings catalog profiles for your custom GPO settings. For the baseline itself, don't migrate the GPO: use the Intune baseline, which is maintained for you.

Step 2: deploy one baseline per product, close to default

Create one profile per baseline type and assign it to device groups ring by ring, as with update rings. Rules that keep it manageable:

• Change as little as possible in the baseline profile. Every modified value is something you must re-check at each version upgrade.
• Put exceptions in separate, narrowly assigned profiles only when the baseline itself can't hold the right value for everyone. A conflicting value in a second profile doesn't override the baseline; it creates a conflict. For a true exception, exclude the device group from the baseline profile and assign a copy with the different value, or change the value in the baseline for everyone.
• Don't assign two versions of the same baseline to the same device.
• Pilot on devices that also run your usual software: the Windows baseline enables settings such as LSA protection and Credential Guard that break old drivers, VPN plug-ins and smart card middleware.

Step 3: avoid overlap with endpoint security policies

Intune can configure the same setting from many places: security baselines, endpoint security policies (Antivirus, Attack surface reduction, Firewall, Account protection, Disk encryption, EDR), settings catalog profiles and templates. When two profiles set the same setting to different values on one device, Intune reports a Conflict for that setting and you can't rely on which value, if any, applies. When they set the same value, there's no conflict, but it's still duplication to maintain.

A practical split:

If a baseline sets something you manage in an endpoint security policy (for example ASR rule states), leave the value identical in both or set it to not configured in the baseline profile and document that the endpoint security policy owns it.

Step 4: handle Group Policy on hybrid devices

Hybrid-joined devices often still receive domain GPOs while Intune pushes baselines. By default, if both configure the same setting, what ends up applied depends on the setting's area and processing order; you should treat that as undefined.

The ControlPolicyConflict area of the Policy CSP provides MDMWinsOverGP (settings catalog: Control Policy Conflict > MDM Wins Over GP; OMA-URI ./Device/Vendor/MSFT/Policy/Config/ControlPolicyConflict/MDMWinsOverGP, integer 1). With it set, Policy CSP settings delivered by MDM take precedence over their Group Policy equivalents. Its limits matter:

• It covers Policy CSP settings that have a Group Policy equivalent. Settings delivered by other CSPs, such as parts of BitLocker, Defender or firewall configuration, are not covered.
• It doesn't remove the GPO; the GPO still processes and still sets everything MDM doesn't.
• Only settings Microsoft maps to a Group Policy equivalent are covered. Check a setting in Microsoft's list of Policies in Policy CSP supported by Group Policy before assuming MDM wins; for anything outside it, Microsoft warns there is a race condition and no guarantee which source wins.

The durable fix is ownership: for each OU of hybrid devices, decide whether GPO or Intune owns security configuration. On co-managed devices with Configuration Manager, move the Device configuration and Endpoint Protection workloads to Intune when Intune becomes the owner, then unlink the old GPOs from those OUs.

Step 5: manage versions

Microsoft publishes new baseline versions as Windows and the products evolve. When a new version appears:

1. Read the settings list and change notes Microsoft publishes for the new version, and review each added, removed and changed setting, as you would with Policy Analyzer for GPOs (see Policy Analyzer and LGPO).
2. In Endpoint security > Security baselines, select the profile and choose Update Version, with the option to keep your existing setting customizations. Intune creates a new, side-by-side profile on the latest version; the original stays unchanged, and its settings become read-only once a newer version exists.
3. The new profile has no assignments or scope tags. Assign it to the pilot group and watch conflict and error reports for a week.
4. Move the remaining groups ring by ring, removing each group from the old profile as you add it to the new one, so the two versions never target the same device. Delete the old profile once nothing is assigned to it.

Profiles created before May 2023 use the older template format and can't be updated in place: export their settings to CSV with Change Version, then recreate them on the current version.

Verify it

In Intune, open the baseline profile and review Device status and Per-setting status. Any setting in Conflict or Error is not doing its job, even if the profile overall looks healthy. On a device:

# Generate the MDM diagnostic report (HTML plus supporting files)
MdmDiagnosticsTool.exe -out C:\Temp\MDMDiag

# Values currently applied through the Policy CSP, per area
Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device' |
  Select-Object -ExpandProperty PSChildName

Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\ControlPolicyConflict' -ErrorAction SilentlyContinue

The same report is available from Settings > Accounts > Access work or school > (your account) > Info > Create report. Policy application errors are logged in Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin; event 404 reports a command failure, with the setting path and error code in the message.

Finally, compare effective state against the baseline intent. Policy Analyzer's effective-state comparison or gpresult /h show whether a GPO is still setting the same values on hybrid devices.

What breaks

• Silent conflicts. A setting in conflict simply doesn't apply. Review per-setting status after every new profile.
• Tattooed settings after unassignment. Removing a baseline doesn't always restore defaults. Set explicit values when you need to roll back.
• Driver and VPN issues from LSA protection, Credential Guard or memory integrity. Pilot on real hardware.
• Double management on hybrid devices. A GPO and an Intune profile fighting over firewall or Defender settings produce intermittent behaviour that is hard to diagnose.
• Assumptions about Windows Server. Intune baselines target client Windows; for Windows Server 2025, use OSConfig as described in the configuration drift guide.

Checklist

• GPO overlap measured with Group Policy analytics
• One profile per baseline type, close to default, assigned by ring
• Exceptions handled by exclusion groups, not conflicting profiles
• Clear ownership between baselines, endpoint security policies and settings catalog
• Hybrid OUs assigned to one owner; MDMWinsOverGP used only during migration
• Conflict and error per-setting reports reviewed after every change
• Version upgrades diffed, piloted and rolled out ring by ring
• Device-side checks documented (MDM diagnostic report, event log)

Intune baselines are the fastest way to a secure configuration on cloud-managed Windows, as long as you keep the configuration sources clean. The rest of the security baselines area covers testing, comparison and drift.