Intune security baseline for Windows 11, version 25H2

The Windows security baseline for Windows 11, version 25H2 is now available in Microsoft Intune. This baseline reflects current Microsoft security recommendations for supported Windows devices and is the latest available Windows security baseline in Intune.

The Windows 11, version 25H2 security baseline includes new settings, updated default values, retired settings, and revised security guidance. Existing security baseline profiles don't automatically update to the new version.

To use the Windows 11, version 25H2 security baseline, Intune admins can create a new baseline profile or update an existing profile to the latest version.

The following two settings aren't included in this baseline release and will be added in a future baseline update. Each change will be communicated to customers when available:

• Disable Internet Explorer 11 launch via COM automation - This setting isn't included at release due to a known issue. The Windows client team is addressing the issue, and the setting will be added in a future baseline update.
• Configure NetBIOS settings - This setting is pending availability in the Settings Catalog and will be added to the baseline in a future update.

We recommend carefully reviewing the settings in the new baseline before moving from a previous baseline version, especially if existing profiles include customizations.

For a detailed breakdown of setting changes, see the Windows blog post Windows 11, version 25H2 security baseline.

To view the default configuration of the Intune baseline for Windows 11, version 25H2, see Windows MDM baseline settings.