Windows 11 26H2 Security Baseline: a practical Intune rollout checklist

What changed

Microsoft's Intune release notes for the week of October 5 confirm availability of the Windows 11 26H2 security baseline. It contains new settings, changed defaults and revised guidance. Administrators can create a new profile or update an existing one; an OS upgrade alone does not update the baseline profile.

Technical details

• Existing baseline profiles are not automatically moved to the new version
• Create a new baseline profile or update an existing profile after reviewing the available settings
• Configure NetBIOS settings is excluded from this release because Microsoft says the setting is currently supported only on Windows Insider builds
• The Windows MDM baseline contains the settings applicable to Windows devices managed through Intune; other baseline types remain separate

Why it matters

Treat an OS upgrade and a baseline change as separate rollout decisions. This Endpoint News checklist helps administrators preserve deliberate exceptions, spot conflicting policy values and gather evidence before broad assignment. It is an operational recommendation, not a report of a completed customer deployment.

Known limitations

• Do not assume every setting in Microsoft's broader Windows baseline is exposed in the Intune MDM baseline
• Review the current Microsoft settings reference for exact values; this article does not claim to be an exhaustive setting-by-setting diff
• Multiple profiles can configure the same setting with different values; resolve conflicts before expanding the pilot
• The checklist is editorial guidance. No tenant screenshots, lab results or compatibility guarantees are claimed

Now check

• Record the current baseline version, assignments and customized settings before making changes
• Compare the proposed settings with the Microsoft reference and document each intentional exception with an owner and review date
• Check overlapping values in Settings Catalog, Endpoint Security, other baseline profiles and applicable Group Policy
• Create a limited pilot using representative device models, user roles and application workloads
• Review per-setting status and conflicts in Intune; test sign-in, VPN, printing and business applications on pilot devices
• Expand assignments only after reviewing pilot evidence. Document how to remove the new assignment and restore intended values, checking each setting's removal behavior