CIS Microsoft Intune for Windows 11 Benchmark v5.0.0: What’s new and key security controls

The CIS Microsoft Intune for Windows 11 Benchmark v5.0.0, released by the Center for Internet Security on 25th June 2026, gives Intune administrators a more focused security baseline for hardening Windows 11 endpoints. If v4.0.0 was about broadening coverage, v5.0.0 is about consolidation and raising the security floor, with a new Device Compliance Policy section, modern SMB hardening controls, LSASS protection improvements, and the removal of legacy or redundant recommendations.

For anyone managing Windows 11 endpoints through Intune, this release is worth setting time aside for, not least because several long-standing controls have been removed. Below I'll walk through what's changed and call out the top three new controls every Intune administrator should be implementing.

What is the CIS Microsoft Intune for Windows 11 Benchmark?

Center for Internet Security (CIS) benchmarks are consensus-driven security configuration guidelines built by industry practitioners. The CIS Microsoft Intune for Windows 11 Benchmark provides a prescriptive set of recommendations for hardening Windows 11 devices managed through Microsoft Intune, delivered via configuration profiles (Settings Catalog), Endpoint security policies, and Device Compliance policies.

The benchmark follows the CIS on-premises Windows OS benchmarks as closely as the MDM control surface allows. Each recommendation is mapped to a Level 1 (core baseline) or Level 2 (may affect functionality) profile, with a separate BitLocker (BL) profile for encryption-specific settings. Most controls are audited and remediated directly in the Intune admin center or verified against the registry keys that back each Settings Catalog path.

What changed in CIS Microsoft Intune for Windows 11 Benchmark v5.0.0?

Version 5.0.0 introduces roughly 22 new controls, 15 updated controls, and around 25 removed controls compared with v4.0.0. This means it’s a slightly smaller benchmark. The total recommendation count drops from approximately 457 to 419, but it is a more focused one, with dead weight removed and meaningful new coverage added.

Several sections have been renumbered because of the removals, therefore if you maintain your own mapping spreadsheet against control numbers rather than titles or GRIDs you will need to reconcile it. Global Recommendation IDs (GRIDs) are present throughout, as they were in v4.0.0, and they remain the most reliable way to track a control across versions.

New CIS benchmark controls for Intune-Managed Windows 11 devices

The 22 new recommendations align into three core themes.

Device Compliance policy controls in Microsoft Intune

The headline addition is an entirely new section covering Intune Device Compliance policies, the first time the benchmark has prescribed compliance-policy settings rather than device configuration alone. Seven new controls, all Level 1, all assessed manually:

• Device Health: BitLocker- set to Require
• Device Health: Secure Boot- set to Require
• Device Health: Code integrity- set to Require
• Device Security: Firewall- set to Require
• Device Security: Trusted Platform Module (TPM)- set to Require
• Device Security: Antivirus- set to Require
• Device Security: Antispyware- set to Require

This is the most strategically significant change in the release. These aren't configuration settings pushed to the device. They're compliance signals that, when paired with Conditional Access, let you gate access to corporate resources on a device's actual health posture.

SMB hardening for Windows 11: Lanman server and workstation controls

All Level 1 controls that modernises SMB:

• Require Encryption(client) - set to Enabled (L1)
• Min Smb2 Dialect- set to SMB 3.1.1, on both client and server (L1)
• Enable Auth Rate Limiterand Auth Rate Limiter Delay In Ms ≥ 2000 (L1), which throttles brute-force authentication attempts against the SMB server
• Enable Mailslots - set to Disabled on both client and server (L1)
• Audit controls for insecure guest logon, and for clients/servers that don't support signing or encryption (L1)

Together these push SMB towards encrypted, signed, modern-dialect-only communication and give you visibility of any legacy traffic that would otherwise pass silently.

Additional Windows 11 security controls added in v5.0.0

• Allow Custom SSPs and APs to be loaded into LSASS- set to Disabled (L1). Prevents custom Security Support Providers / Authentication Packages loading into LSASS, closing a credential-interception vector.
• Require Ipps Policy- set to Enabled (L2). Forces IPP printer communication over TLS (IPPS). There is an explicit warning to assess printers first as printers using self-signed or locally issued certificates will be affected.

Updated CIS Benchmark controls in v5.0.0

The substantive updates worth flagging:

Tightening:

• Network security: LAN Manager authentication levelhas been tightened from ‘Send LM and NTLMv2 responses only. Refuse LM and NTLM’ to ‘Send NTLMv2 responses only. Refuse LM and NTLM’, a stricter stance that refuses LM and NTLM outright rather than merely refusing to accept them.
• Password Complexity(Windows LAPS) has been updated to include passphrases alongside the existing complexity requirement.
• Firewall log file path controls (Domain / Private / Public) have moved from requiring a specific hard-coded path to simply requiring that a path is configured, a more practical audit that no longer fails environments using a non-default log location.

Profile changes (L1 → L2):

Several controls have been demoted from Level 1 to Level 2, meaning they're no longer part of the core baseline:

• Allow widgets- set to Not allowed
• Limit Dump Collectionand Limit Diagnostic Log Collection
• Interactive logon: Do not require CTRL+ALT+DEL- set to Disabled

If your current baseline enforces these at L1, the benchmark no longer requires it, but there's nothing stopping you keeping the stricter setting where it makes sense.

Removed CIS Benchmark vontrols in v5.0.0

Around 25 recommendations have been retired. Rather than list them all, the removals fall into a few clear groups:

• The Device Lock password cluster (9 controls).The entire set of device password recommendations (password length, complexity, history, expiration, failed-attempt lockout, inactivity lock and so on) has been removed from the Device Lock section, which is now an empty placeholder. Password and PIN posture on Intune-managed Windows is increasingly governed through Windows Hello for Business and account-protection policy rather than legacy device-password settings, and this removal reflects that shift.
• BitLocker startup authentication (5 controls).The ‘Require additional authentication at startup’ family (TPM startup, startup PIN, startup key, and BitLocker-without-a-compatible-TPM) has been removed. These GPO-era pre-boot authentication settings are increasingly at odds with modern silicon and Autopilot deployment models.
• Redundant SMB signing controls.Microsoft network client / server: Digitally sign communications (if server/client agrees) have both been removed. The stronger (always) signing controls remain in place, making the weaker ‘if agrees’ variants redundant.
• Legacy hardening now handled elsewhere.Do not store LAN Manager hash value on next password change, MSI Always install with elevated privileges, background Group Policy refresh, and the Defer Feature Updates period control have all gone, along with the Microsoft Defender Antivirus / Defender configuration-template recommendations.

What happened to Microsoft Defender Antivirus controls?

The Defender Antivirus removal is worth its own section. It does not mean the benchmark has stopped caring about antivirus.

The new Device Compliance Antivirus and Antispyware controls (section 106) shift that assurance from ‘is this policy template configured?’ to ‘is a WSC-registered AV solution actually running at check-in?’ which is a stronger and more outcome-focused position.

If you are then wondering how do you know if you’ve configured Defender Antivirus correctly, you’ll be pleased to hear that these controls have been separated out into their own benchmark Microsoft Intune for Microsoft Defender Antivirus v1.0.0.

Top 3 CIS Microsoft Intune security controls to implement first

Of the 22 new recommendations, three stand out as high-impact additions that materially change your endpoint security posture. All three are Level 1, and the first is arguably the most consequential single change in the benchmark's history.

1. Device Compliance policy for Windows 11 device health and system security

I'm treating the new Device Compliance section as a single recommendation to implement, because that's how it delivers value: as a compliance policy that bundles the seven health signals together.

For the first time, the benchmark prescribes what a Windows 11 device must prove about itself, not just what you push to it. The seven controls require that BitLocker, Secure Boot, Code Integrity, a functioning TPM, the Windows Firewall, antivirus, and antispyware are all present and healthy, verified at each device check-in, several of them via the Windows Health Attestation Service rather than a self-reported registry value.

On its own, a compliance policy just labels devices compliant or non-compliant. The power comes from pairing it with a Conditional Access policy that requires a compliant device to reach corporate resources. That combination turns device health from a dashboard metric into an enforced access gate: a device that has had BitLocker disabled, its firewall switched off, or Secure Boot turned off in firmware loses access until it's remediated.

Why prioritise this one:

• It's the difference between hoping your configuration profiles applied and proving the device is in a known-good state before it touches your data.
• Attestation-backed checks (BitLocker, Secure Boot, TPM, Code Integrity) are far harder for a compromised or misconfigured device to spoof than registry-based configuration checks.
• It consolidates seven of the most important endpoint assurances into one policy that's straightforward to build.

Watch-outs:

• Devices that aren't yet encrypted, or where encryption is still in progress, will be marked non-compliant, and if Conditional Access is already gating on compliance, that means lost access. Stage the compliance policy and monitor the non-compliance report before you tie it to Conditional Access.
• The Firewallcheck can transiently report an Error immediately after a reboot or wake-from-sleep; a manual device sync re-evaluates it. Factor this into your helpdesk guidance.
• Third-party AV must be registered with Windows Security Center to satisfy the Antivirus/Antispyware checks; a functionally active but non-WSC-integrated product will fail.
• Older hardware without TPM 2.0, or where the TPM is disabled in firmware, will fail the TPM check. Identify these devices before enforcement.

2. Disable custom SSPs and APs in LSASS to reduce credential theft risk

LSASS is one of the most valuable targets on any Windows endpoint, holding the credential material attackers need to move laterally. This control disables the ability for custom Security Support Providers and Authentication Packages to be loaded into the LSASS process, closing a well-understood technique for intercepting logon credentials.

Crucially, the default state is Enabled, meaning LSASS will load custom SSPs/APs out of the box. Most tenants are therefore exposed unless they've explicitly hardened this, which makes it a high-value, low-effort win.

Why prioritise this one:

• It directly reduces the attack surface around credential theft, which underpins the majority of hands-on-keyboard intrusions.
• It's a single Settings Catalog value with a clear, safe default-to-secure change.
• It pairs naturally with LSA protection (Run as PPL) and Credential Guard as part of a layered LSASS-hardening strategy.

Watch-outs:

• Some legitimate third-party security or authentication products register their own SSP/AP. Test in a pilot ring to confirm nothing in your estate relies on loading a custom package into LSASS before broad rollout.

3. SMB encryption and minimum SMB 3.1.1 dialect for Windows 11

SMB remains a heavily targeted protocol for interception and lateral movement, and much of the exposure comes from older, unencrypted, lower-dialect traffic that flows silently. These new controls raises the SMB floor: requiring encryption on the SMB client, mandating a minimum dialect of SMB 3.1.1 on both client and server, and adding audit logging so you can see any legacy traffic that would otherwise be invisible.

Why prioritise this one:

• It closes off SMBv1/v2-era interception and downgrade paths by refusing anything below SMB 3.1.1.
• Requiring client-side encryption protects data in transit even where a server hasn't mandated it.
• The accompanying audit controls give you the visibility to find non-compliant devices and appliances before you enforce, rather than discovering them through broken connections.

Watch-outs:

• Requiring encryption and a 3.1.1 dialect floor will break connectivity to legacy systems (Windows 7 / Server 2008 R2 and older) and to third-party NAS devices or appliances that don't support SMB v3. Enable the audit controls first, review the events, and remediate or exempt legacy endpoints before turning on enforcement.

Summary: Preparing for CIS Microsoft Intune for Windows 11 Benchmark v5.0.0

Version 5.0.0 is a maturity release. The headline is the arrival of Device Compliance policy recommendations, which move the benchmark from ‘configure the device correctly’ to ‘prove the device is healthy before it gets access’, a meaningful shift that lands best when paired with Conditional Access. Around that, the SMB and LSASS additions close well-known attack paths, while the substantial removals strip out legacy device-password and pre-boot-authentication settings that no longer fit modern, cloud-managed Windows 11 estates.

If your devices are already aligned to v4.0.0, the practical work here is threefold: stand up a Device Compliance policy and stage it carefully behind a grace period, adopt the SMB and LSASS hardening after an audit-first pilot, and reconcile your control mapping against the renumbered sections. It's a release that rewards planning over a rushed rollout, particularly anywhere compliance state is about to start gating access.

Need additional support? 

OneAdvanced's relationship with Microsoft goes back over 30 years, over which our  Modern Workplace experts have helped numerous organisations digitally transform and embrace a better way of working. If you’d like to explore which Microsoft 365 tools could deliver the most impact for your team, contact us to find out more, you may be surprised at the value that’s already within your reach.