Intune security baselines: updating to a new version, fixing conflicts and rolling back

A new security baseline version appears in Intune, your existing profiles stop being editable, and someone has to move the tenant forward without breaking anything. The update is safer than it looks once you know that Intune builds a copy rather than changing the live profile. In this post I'll explain how baseline versions work, walk through the update and a pilot, and show how to find conflicts and roll back.

How baseline versions work#

Baselines live under Endpoint security › Security baselines in the Microsoft Intune admin center. Each baseline type has versions, and these are the recent ones as published on Microsoft Learn at the time of writing (check the list again before you plan):

The rules that matter when a new version ships:

• Existing profiles don't upgrade automatically, and their settings become read-only. You can still change the name, description and assignments, and they keep deploying.
• New profiles can only use the latest version, and an update always goes to the latest version of the same baseline type.
• For profiles created in May 2023 or later, Update Version creates a new, side-by-side profile. The original keeps its settings, scope tags and assignments; the copy gets none of the assignments or scope tags.
• Profiles created before May 2023 use an older format and can't be converted. You recreate them in the new format, helped by a CSV export of your customizations.

Prerequisites#

• Intune Plan 1, plus a subscription for the managed product where applicable: the Defender for Endpoint baseline doesn't license Defender for Endpoint.
• An Intune role with the Security baselines permissions (Read, Create, Update, Delete, Assign). The least privileged built-in role that can manage baselines is Policy and Profile Manager.
• On co-managed devices, the Device configuration workload must be switched to Intune.
• A pilot device group that mirrors your hardware, apps and network setups.

Step-by-step#

1. See which versions you run#

Open a baseline type, then Profiles and Versions. Intune lists the versions your profiles use and the latest available. Profiles with a newer version available show an arrow icon.

2. Create the updated profile#

1. On the Profiles page, select the check box for the profile and choose Update Version.
2. Pick Accept baseline changes but keep my existing setting customizations (usually right) or Accept baseline changes and discard existing setting customizations (a clean default profile), then select Create.
3. Name the new profile with the version in it, for example WIN-BL-SecurityBaseline-26H2-v1.
4. On Configuration settings, review new settings and changed defaults. New settings arrive with Microsoft's recommended value, which is where most surprises hide.
5. Add scope tags again; they aren't copied.
6. Assign only the pilot group for now, then create the profile.

3. For profiles created before May 2023#

Select the profile and choose Change Version, then Export Profile Settings. The CSV has three columns: DefinitionId (the setting's CSP name), defaultJson (the default in the new format) and customizedJson (your old value, or NotApplicable where you kept the default). Create a new profile from the same pane, reapply your customizations, and retire the old profile when the new one is proven.

4. Pilot, then move everyone#

Give the pilot a working week covering sign-in, VPN, printing, line-of-business apps and remote support. Then move the remaining groups in waves, removing each group from the old profile as you add it to the new one, and delete the old profile once nothing is assigned to it.

Find and fix conflicts#

Baseline defaults are almost always the most restrictive option, and different baseline types can set the same setting to different values (the Windows and Defender for Endpoint baselines are the classic pair). Endpoint security policies and settings catalog profiles often manage the same settings too. Microsoft's own example is firewall: the baseline's defaults might not merge local and connection security rules with MDM rules, so validate them before assigning if you rely on Delivery Optimization.

1. Open the profile, select View report and then Generate report for device and user check-in status.
2. Select a device with a status other than Succeeded to open its Profile Settings view.
3. Select the failing setting. The Setting Details pane lists every profile assigned to that device that configures the same setting.
4. Choose one owner. Either set the setting to Not configured in the baseline, or remove it from the other policy.

The MDM diagnostic report confirms the result from the device side, and firewall-specific conflicts are covered in Intune firewall rules not applying.

Rolling back#

Removing an assignment or setting a value to Not configured doesn't reliably undo a baseline. Each setting is handled by its CSP, and many keep their last value until something else manages them. Two practical consequences:

• The quickest rollback during a pilot is to put the group back on the old profile, which still deploys even though it's read-only, and remove it from the new one.
• To undo one setting, configure the value you want explicitly, in the baseline or in a separate policy that owns it, rather than just unmanaging it.

Verify#

• The new profile's report shows Succeeded for the pilot devices, with no Conflict or Error states and few Pending after a sync.
• The old profile no longer lists the moved groups, and the version view shows your profiles on the latest version.
• On a device, the MDM diagnostic report (Settings › Accounts › Access work or school, select the account, Info, Create report) shows the expected values, and the policy values are under the PolicyManager key:

Get-ChildItem 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device' |
    Select-Object -ExpandProperty PSChildName

Tips & gotchas#

• Microsoft says the Defender for Endpoint baseline isn't currently recommended for virtual machines or VDI, because some settings affect remote interactive sessions.
• Baselines are assigned to user or device groups depending on the scope of their settings, so you may need more than one instance.
• Duplicate copies settings and scope tags but not assignments, which makes it a safe way to test a variation.
• Settings dropped from a new version are no longer enforced but stay on devices at their last value.
• Where baselines fit next to the settings catalog and endpoint security is covered in choosing the right Intune policy type.

References#

• Manage security baseline profiles in Microsoft Intune
• Learn about Intune security baselines for Windows devices
• Monitor security baselines and profiles in Microsoft Intune