Check your readiness
Device management · Microsoft

Microsoft Intune policies for Cyber Essentials

Five controls, in scheme order, with the setting path and question number for every step. Applies to Microsoft Intune with Windows 11 25H2 and iOS 26 devices (paths checked against Microsoft Learn).

Reviewed against vendor docs 2026-11
Updated 3 November 2026
Short answer

Intune can evidence four of the five Cyber Essentials controls on managed devices: the Windows firewall, device locking and AutoPlay, update rings that install critical updates within 14 days, standard-user enforcement, and Defender Antivirus. Compliance policies flag unsupported operating systems and unlocked devices for A6.1 and A5.9.

Key facts
Platform
Microsoft Intune (Microsoft)
Applies to
Microsoft Intune with Windows 11 25H2 and iOS 26 devices (paths checked against Microsoft Learn)
Paths last checked
2026-11
Controls covered
Firewalls, Secure configuration, Security update management, User access control, Malware protection
Steps
23 settings across 5 controls
Reviewed against
Requirements v3.3 and the Danzell question set v16.3

A4: how do you configure Microsoft Intune for firewalls?

Apply 3 settings in Microsoft Intune: enforce the Windows firewall on all profiles, enforce the macOS firewall and check the firewall status report. Together they provide evidence for A4.1.1 and A4.7.

Software firewalls on every Windows and macOS device are required by A4.1.1. Intune enforces and reports on them. See the firewalls requirements for what the control asks.

  1. Enforce the Windows firewall on all profiles

    A4.1.1A4.7
    Intune admin center > Endpoint security > Firewall > Create policy > Platform: Windows > Profile: Windows Firewall > Domain, Private and Public Profile: Enable Firewall: True, Default Inbound Action: Block

  2. Enforce the macOS firewall

    A4.1.1
    Intune admin center > Endpoint security > Firewall > Create policy > Platform: macOS > Profile: macOS Firewall > Enable Firewall: Yes, Enable Stealth Mode: Yes

  3. Check the firewall status report

    A4.1.1
    Intune admin center > Reports > Firewall > MDM Firewall status for Windows

    Export this report as evidence; it lists devices where any profile is off.

A5: how do you configure Microsoft Intune for secure configuration?

Apply 5 settings in Microsoft Intune: require a lock and set the PIN or password minimum, turn off AutoPlay and AutoRun, disable the built-in Guest and Administrator accounts, manage local admin passwords with Windows LAPS and require a passcode on iOS, iPadOS and Android. Together they provide evidence for A5.9, A5.10, A5.8, A5.2, A5.3, A7.2 and A2.8.

Device locking, AutoPlay, default accounts and local administrator passwords are all policy settings in Intune. See the secure configuration requirements for what the control asks.

  1. Require a lock and set the PIN or password minimum

    A5.9A5.10
    Intune admin center > Devices > Compliance > Create policy > Windows 10 and later > System Security > Require a password to unlock mobile devices: Require, Minimum password length: 6 (12 if the same credential signs in to the network), Maximum minutes of inactivity before password is required: 15

  2. Turn off AutoPlay and AutoRun

    A5.8
    Intune admin center > Devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog > Administrative Templates > Windows Components > AutoPlay Policies > Turn off AutoPlay: Enabled (All drives), Set the default behavior for AutoRun: Do not execute any autorun commands

  3. Disable the built-in Guest and Administrator accounts

    A5.2A5.3
    Intune admin center > Devices > Configuration > Create > Windows 10 and later > Settings catalog > Local Policies Security Options > Accounts Enable Guest Account Status: Disabled, Accounts Enable Administrator Account Status: Disabled

    If you need the local Administrator account, keep it enabled and manage its password with LAPS below.

  4. Manage local admin passwords with Windows LAPS

    A5.3A7.2
    Intune admin center > Endpoint security > Account protection > Create policy > Windows > Local admin password solution (Windows LAPS) > Backup Directory: Backup the password to Microsoft Entra ID only, Password Age Days: 30, Password Complexity: Large letters + small letters + numbers + special characters

  5. Require a passcode on iOS, iPadOS and Android

    A5.9A5.10A2.8
    Intune admin center > Devices > Compliance > Create policy > iOS/iPadOS (and Android Enterprise) > System Security > Require a password to unlock mobile devices: Require, Minimum password length: 6, Maximum minutes after screen lock before password is required: Immediately

A6: how do you configure Microsoft Intune for security update management?

Apply 5 settings in Microsoft Intune: create an update ring that installs within 14 days, pin feature updates to a supported release, flag devices below the minimum OS build, keep Microsoft 365 Apps on a current channel and update third-party apps. Together they provide evidence for A6.4, A6.4.1, A6.1, A2.6, A6.5, A6.5.1, A6.2.4 and A6.5.2.

Update rings and compliance policies are the two artefacts an assessor wants: one that installs updates inside 14 days, one that flags devices that fall behind. See the security update management requirements for what the control asks.

  1. Create an update ring that installs within 14 days

    A6.4AUTO-FAILA6.4.1
    Intune admin center > Devices > By platform > Windows > Manage updates > Windows updates > Update rings tab > Create profile > Quality update deferral period (days): 0, Feature update deferral period (days): 0, Automatic update behavior: Auto install and restart at maintenance time, Deadline for quality updates: 7, Grace period: 2

    Deferral plus deadline plus grace must total less than 14 days. Also set Option to pause Windows updates: Disable, so users cannot pause past the window.

  2. Pin feature updates to a supported release

    A6.1
    Intune admin center > Devices > Windows > Windows updates > Feature updates > Create profile > Feature update to deploy: Windows 11, version 26H2 (or 25H2, supported for Home and Pro to 12 October 2027)

  3. Flag devices below the minimum OS build

    A6.1A2.6
    Intune admin center > Devices > Compliance > Create policy > Windows 10 and later > Device Properties > Operating System Version > Minimum OS version: the current supported build (for example 10.0.26200) > Actions for noncompliance: Mark device noncompliant immediately

  4. Keep Microsoft 365 Apps on a current channel

    A6.5AUTO-FAILA6.5.1A6.2.4
    Intune admin center > Apps > Windows > Create > Microsoft 365 Apps (Windows 10 and later) > Configure app suite (Configuration designer) > Update Channel: Current Channel, Remove other versions: Yes

  5. Update third-party apps

    A6.5.2
    Intune admin center > Apps > All Apps > Create > Enterprise App Catalog app (Enterprise App Management add-on), or a Win32 app supersedence rule per application

    Without the add-on, use winget in a scheduled remediation script and keep the output as evidence.

A7: how do you configure Microsoft Intune for user access control?

Apply 5 settings in Microsoft Intune: enrol users as standard users, control the local Administrators group, set account lockout to 10 attempts, configure Windows Hello for Business and require a compliant device in Conditional Access. Together they provide evidence for A7.6, A7.7, A7.8, A7.10, A5.10, A7.11 and A7.17.

Standard users by default, a separate admin route, lockout and a strong local credential policy. See the user access control requirements for what the control asks.

  1. Enrol users as standard users

    A7.6A7.7
    Intune admin center > Devices > By platform > Windows > Enrollment > Windows Autopilot: Deployment profiles > Create profile > Windows PC > User account type: Standard

  2. Control the local Administrators group

    A7.6A7.8
    Intune admin center > Endpoint security > Account protection > Create policy > Windows > Local user group membership > Local group: Administrators > Group and user action: Add (Replace) > add only the admin group

  3. Set account lockout to 10 attempts

    A7.10
    Intune admin center > Devices > Configuration > Create > Windows 10 and later > Settings catalog > Device Lock > Account Lockout Policy > Account lockout threshold: 10, Account lockout duration: 15 minutes (Windows 11 22H2 with KB5053657, 24H2 and later)

  4. Configure Windows Hello for Business

    A5.10A7.11
    Intune admin center > Devices > Enrollment > Windows tab > Enrollment options: Windows Hello for Business > Configure Windows Hello for Business: Enabled, Minimum PIN length: 6, Use security keys for sign-in: Enabled

  5. Require a compliant device in Conditional Access

    A7.17AUTO-FAIL
    Entra admin center > Entra ID > Conditional Access > Policies > New policy > Grant: Require device to be marked as compliant

    A managed device is one of the four factor types in the requirements; pair it with MFA rather than replacing it.

A8: how do you configure Microsoft Intune for malware protection?

Apply 5 settings in Microsoft Intune: deploy the Defender Antivirus policy, turn on SmartScreen and stop users bypassing it, protect macOS with Defender, restrict mobile app installs to approved sources and check the antivirus status report. Together they provide evidence for A8.1, A8.2, A8.3, A8.4 and A8.5.

Defender Antivirus policy plus SmartScreen covers A8.1 to A8.3 on Windows. Managed app stores cover A8.4 and A8.5 on mobile. See the malware protection requirements for what the control asks.

  1. Deploy the Defender Antivirus policy

    A8.1A8.2
    Intune admin center > Endpoint security > Antivirus > Create policy > Platform: Windows > Profile: Microsoft Defender Antivirus > Allow Realtime Monitoring: Allowed, Allow Cloud Protection: Allowed, PUA Protection: PUA Protection on, Enable Network Protection: Enabled (block mode), Signature Update Interval: 4

  2. Turn on SmartScreen and stop users bypassing it

    A8.3
    Intune admin center > Devices > Configuration > Create > Windows 10 and later > Settings catalog > Microsoft Edge > SmartScreen settings > Configure Microsoft Defender SmartScreen: Enabled, Prevent bypassing Microsoft Defender SmartScreen prompts for sites: Enabled; and Settings catalog > SmartScreen > Enable Smart Screen In Shell: Enabled, Prevent Override For Files In Shell: Enabled

  3. Protect macOS with Defender

    A8.1A8.2
    Intune admin center > Endpoint security > Antivirus > Create policy > Platform: macOS > Profile: Antivirus > turn on real-time protection and cloud-delivered protection (Defender for Endpoint must be installed on the Mac)

  4. Restrict mobile app installs to approved sources

    A8.4A8.5
    Intune admin center > Devices > Configuration > Create > Android Enterprise (fully managed or corporate-owned work profile) > Device restrictions > Applications > Allow installation from unknown sources: leave Not configured, never Allow; iOS/iPadOS > Device restrictions > App Store, Doc Viewing, Gaming > Block App store: Yes (supervised devices, with apps deployed from Apple Business)

  5. Check the antivirus status report

    A8.2
    Intune admin center > Reports > Microsoft Defender Antivirus > Reports tab > Antivirus agent status

Which questions does this guide cover?

The 28 questions below are the ones Microsoft Intune can provide evidence for. Use the step names in your notes field. Any question not listed still needs answering from your other devices, firewalls and cloud services.

QuestionWhat it asksSteps in this guide
A2.6Please list the quantities and operating systems for your laptops, desktops and virtual desktops within the scope of this assessment.A6: Flag devices below the minimum OS build
A2.8Please list the quantities of tablets and mobile devices within the scope of this assessment.A5: Require a passcode on iOS, iPadOS and Android
A4.1.1Do you have software firewalls enabled on all of your computers, laptops and servers?A4: Enforce the Windows firewall on all profiles; A4: Enforce the macOS firewall; A4: Check the firewall status report
A4.7Is your firewall configured to allow unauthenticated inbound connections?A4: Enforce the Windows firewall on all profiles
A5.10Which method do you use to unlock the devices?A5: Require a lock and set the PIN or password minimum; A5: Require a passcode on iOS, iPadOS and Android; A7: Configure Windows Hello for Business
A5.2Have you ensured that all your laptops, computers, servers, tablets, mobile devices and cloud services only contain necessary user accounts that are regularly used in the course of your business?A5: Disable the built-in Guest and Administrator accounts
A5.3Have you changed the default password for all user and administrator accounts on all your desktop computers, laptops, thin clients, servers, tablets and mobile phones that follow the Password-based authentication requirements of Cyber Essentials?A5: Disable the built-in Guest and Administrator accounts; A5: Manage local admin passwords with Windows LAPS
A5.8Have you disabled any feature which allows automatic file execution of downloaded or imported files without user authorisation?A5: Turn off AutoPlay and AutoRun
A5.9When a device requires a user to have the device in hand, do you set a locking mechanism on your devices to access the software and services installed?A5: Require a lock and set the PIN or password minimum; A5: Require a passcode on iOS, iPadOS and Android
A6.1Are all operating systems on your devices supported by a vendor that produces regular security updates and vulnerability fixes?A6: Pin feature updates to a supported release; A6: Flag devices below the minimum OS build
A6.2.4Please list all office applications that are used to create organisational data.A6: Keep Microsoft 365 Apps on a current channel
A6.4AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for operating systems and router and firewall firmware installed within 14 days of release?A6: Create an update ring that installs within 14 days
A6.4.1Are all updates applied for operating systems by enabling auto updates?A6: Create an update ring that installs within 14 days
A6.5AUTO-FAILAre all high-risk or critical security updates and vulnerability fixes for software (including any associated files and extensions) installed within 14 days of release?A6: Keep Microsoft 365 Apps on a current channel
A6.5.1Are all updates applied on your applications by enabling auto updates?A6: Keep Microsoft 365 Apps on a current channel
A6.5.2Where auto updates are not being used, how do you ensure all high-risk or critical security updates and vulnerability fixes of all software are applied within 14 days of release?A6: Update third-party apps
A7.10Where you have systems that require passwords (or where passwords are a backup for a passwordless system), how are they protected from brute-force attacks?A7: Set account lockout to 10 attempts
A7.11Which technical controls are used to manage the quality of your passwords within your organisation?A7: Configure Windows Hello for Business
A7.17AUTO-FAILHas MFA been applied to all users of your cloud services, excluding any listed in A7.15 that do not provide it?A7: Require a compliant device in Conditional Access
A7.2Are all your user and administrative accounts accessed by entering unique credentials?A5: Manage local admin passwords with Windows LAPS
A7.6How does your organisation make sure that separate accounts are used to carry out administrative tasks (such as installing software or making configuration changes)?A7: Enrol users as standard users; A7: Control the local Administrators group
A7.7How does your organisation prevent administrator accounts from being used to carry out everyday tasks like browsing the web or accessing email?A7: Enrol users as standard users
A7.8Do you formally track which users have administrator accounts in your organisation?A7: Control the local Administrators group
A8.1Are all of your desktop computers, laptops, tablets and mobile phones protected from malware by either:A8: Deploy the Defender Antivirus policy; A8: Protect macOS with Defender
A8.2If Option A has been selected: Where you have anti-malware software installed, is it set to update in line with the vendor's guidelines and prevent malware from running on detection?A8: Deploy the Defender Antivirus policy; A8: Protect macOS with Defender; A8: Check the antivirus status report
A8.3If Option A has been selected: Where you have anti-malware software installed, is it set to scan web pages you visit and warn you about accessing malicious websites?A8: Turn on SmartScreen and stop users bypassing it
A8.4If Option B has been selected: Where you use an app-store or application signing, are users restricted from installing unsigned applications?A8: Restrict mobile app installs to approved sources
A8.5If Option B has been selected: Where you use an app-store or application signing, do you ensure that users only install applications that have been approved by your organisation and do you maintain this list of approved applications?A8: Restrict mobile app installs to approved sources

What evidence should you keep for the assessor?

Keep the 5 dated records listed below for Microsoft Intune. They back up your notes fields and are what an assessor asks to see if an answer needs clarifying.

The self-assessment does not upload screenshots, but the notes fields must describe how each control is met, and Cyber Essentials Plus checks the configuration directly. Keep them in one folder, dated, and refresh them before each annual renewal. If you want the settings checked against the question set before you submit, a gap analysis covers it.

  • Export of the update ring and feature update profiles, with assignment groups.
  • Compliance policy summary report showing minimum OS version and lock settings, with the count of non-compliant devices.
  • MDM Firewall status for Windows and Antivirus agent status reports from the Intune Reports node.
  • Local user group membership policy showing the Administrators group contents.
  • Settings catalog export for AutoPlay, account lockout and SmartScreen.
How assessors check this
An assessor reading your A6.4 or A7.16 notes wants the mechanism, not a yes. "Update ring with 0-day deferral and 7-day deadline, assigned to all devices" passes. "Updates are automatic" invites a clarification request.
Common failure
A policy exists but is assigned to nobody, or excludes the group that matters. Check assignments and exclusions before you answer yes; the Cyber Essentials Plus tester samples the devices and accounts you least expect.

Related guides and requirements

Frequently asked questions

Partly. Compliance proves a device is at or above a minimum build on the day of the report. To evidence the 14-day window itself, keep the update ring settings (deferral, deadline and grace period) and a Windows update report from Reports > Windows updates showing install dates against Patch Tuesday.

Yes. App protection policies alone do not evidence device locking or OS version for A5.9 and A6.1, so enrol BYOD phones in Intune or use a compliance policy with the Company Portal. If staff refuse enrolment, the device cannot access organisational data and stays out of scope.

They are still in scope if they access organisational data or services. Either enrol them, evidence the controls manually using the Windows 11 or macOS guide, or remove their access.

Yes, if the daily account is a standard user. Test case 5.1 has the assessor watch a user try to run an administrative process; it passes when Windows asks for a separate administrator login and the process does not run under the user's own account. Autopilot with User account type: Standard and a Local user group membership policy that replaces the Administrators group gives that result.

No single platform covers the whole assessment. Cyber Essentials applies to every in-scope device, cloud service and network boundary. This guide covers what this platform can evidence; you still need to answer the scope questions in A2 and cover any other devices, firewalls and cloud services you use.

The self-assessment is declarative. You answer the questions and write notes; screenshots are not uploaded. Keep them anyway. They let you answer the notes fields precisely, they speed up Cyber Essentials Plus, and they are what an assessor asks for if an answer needs clarifying.

Free readiness check

Would you pass the 2026 question set?

Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.

Check your readinessBook a gap analysis, from £500
  • IASME Certification Body
  • CREST accredited
  • IASME fee included
  • UK offices in Leeds, Newcastle, London and Edinburgh
Sources