Device hardening

This section of the setup helper gets hardening baselines for Windows, macOS and Linux devices under way safely: which baseline every customer starts with, audit first, then enforcement in a pilot ring and the rest inside the maintenance window. It sits in the Security phase and takes about 25 minutes.

Open it from Home > Set up, then Device hardening. It runs through the same six beats as every section: see Working through a section.

Nothing in this section changes a setting on a device. It assigns a baseline in audit, so devices report what they would change, and it sets the rules that enforcement follows when you choose to enforce.

Before you start#

• Finish Company, brand and regional first. Until then the section shows Blocked.
• It works best after Agent and rollout, because the agent does the auditing.
• The section is in your plan when the Device hardening module is on and discovery says you manage devices or provide security. Otherwise it is listed as not needed, with the reason.

What it reads from your data#

What we found shows:

• baselines available, and how many are assigned;
• devices that have audited;
• settings not compliant on devices;
• how many library settings your customers' Intune policies already set.

The questions it asks#

The starting baseline is assigned in audit: devices report what they would change, and nothing is changed until you enforce. Quick wins are the high-value, low-risk settings. The share of devices is the pilot ring, unless an assignment names a device group for it.

What it recommends and why#

There is one recommendation, and it depends on the first answer:

• Audit every customer against the starting baseline, and set how enforcement rolls out. The baseline is assigned to every customer in audit, and the pilot share, the wait before the rest follow and the default exception length are saved. The preview shows "Nothing assigned to every customer" under Now and the baseline's name under Will be.
• If you chose None for now, only the rollout rules are saved, and you assign baselines when you are ready from Settings > Hardening.

Press Apply when the preview is right. An apply can be undone for 7 days, which takes the assignment away again.

Tip: Auditing first costs nothing and tells you a lot. Within a day you can see where every customer stands, and which settings Group Policy or Intune already manage, before you decide what to enforce.

Checking it worked#

Verify runs three live checks:

• A hardening baseline is assigned. If none is, assign one to every customer in Settings > Hardening. It only audits until you enforce.
• Devices with a baseline have audited in the last day. It waits until a baseline is assigned. If no device has audited, check the agents are up to date and online.
• No hardening run has waited a week for its approval. A run that needs an approval and has sat for more than a week is counted here, so it does not get forgotten.

Day to day#

• Open a customer and choose Hardening: compliance per baseline and device, what is managed by Intune or Group Policy, and the runs. A device's Hardening tab has every setting with enforce, roll back and exception.
• When the audit looks right, enforce a baseline. Risky settings go to the pilot ring first and need an approval, the rest follow in each device's maintenance window, and any run can be rolled back.
• Baselines and the setting library are in Security > Hardening. Assignments, exceptions and runs across every customer are in Settings > Hardening.

Related guides#

• Device hardening overview
• The setting library and baselines
• Assigning and auditing
• Enforcing in rings and rolling back
• Group Policy and Intune
• Drift and reporting
• macOS and Linux