windows-11-security-baseline
Windows 11 Security Baseline
The Windows 11 security baseline is Microsoft's curated set of recommended security settings — hundreds of policies vetted for both security value and compatibility. The baseline is delivered as Intune security baselines (settings catalog edition) or GPO templates from the Microsoft Security Compliance Toolkit.
This skill covers what to enable, the Windows 11-specific controls (LAPS, VBS/HVCI, Credential Guard, Smart App Control, PDE), and the rollout pattern.
When to use
Hardening a Windows 11 fleet with Intune (or GPO for legacy estates), with focus on the hardware-rooted and identity-protection capabilities specific to modern Windows.
Do not use this skill for MDE policy authoring (defender-for-endpoint), generic
Intune device management (intune-device-mgmt), or BitLocker-only design
(bitlocker-design).