10.06.26 Update: The Windows security baseline for Windows 11, version 26H2 is now available for all customers in Microsoft Intune. This baseline reflects current Microsoft security recommendations and is the latest available Windows security baseline in Intune.
Windows 11, version 26H2 is now available, and Microsoft Intune provides day zero support for validated Windows policy settings in the settings catalog.
We continue to invest in the settings catalog infrastructure to ensure timely support for new Windows policy settings. This enables organizations to adopt new OS versions and features without delay and maintain secure, compliant, and well-managed environments.
Settings catalog support for Windows 11, version 26H2
As part of Windows 11, version 26H2 settings catalog support, the settings catalog now includes all newly released settings and updates to existing settings introduced with the latest Windows 11, version 26H2 release.
The following table highlights settings that are now available for configuration in the settings catalog and ready to use in device configuration profiles for Windows endpoints. While this update aligns with Windows 11, version 26H2 support, not every setting listed is a new 26H2 feature; some are existing Windows settings that are now available for management through the settings catalog.
| Category | Policy Name | Friendly Name |
|---|---|---|
| Above Lock | ConfigureAudioOnLockScreen | Configure Audio On Lock Screen |
| Application Management | EnableMsixAllowedZones | Enable MSIX Allowed Zones |
| Device Lock | ClearTextPassword | Clear Text Password |
| Device Lock | RelaxMinimumPasswordLengthLimits | Relax Minimum Password Length Limits |
| Printers | ConfigureWindowsReadyPrintDriverRanking | Configure Windows Ready Print Driver Ranking |
| Privacy | LetAppsAccessForegroundText | Let Apps Access Foreground Text |
| Privacy | LetAppsAccessForegroundText_ForceAllowTheseApps | Let Apps Access Foreground Text – Force Allow These Apps |
| Privacy | LetAppsAccessForegroundText_ForceDenyTheseApps | Let Apps Access Foreground Text – Force Deny These Apps |
| Privacy | LetAppsAccessForegroundText_UserInControlOfTheseApps | Let Apps Access Foreground Text – User In Control Of These Apps |
| Windows Update | IgnoreWindowsUpdateGroupPolicies | Ignore Windows Update Group Policies |
| Windows Update | SetMaxPauseDays | Set Max Pause Days |
What this means for administrators
Administrators can find the new settings within the settings catalog in the Microsoft Intune admin center under Devices > Manage devices > Configuration > Create > New policy. Select Windows 10 and later for the platform and settings catalog for the profile type.
Before deploying Windows 11, version 26H2:
- Review the new and updated settings that apply to your organization.
- Test configuration profiles with a representative device group.
- Confirm that the targeted Windows edition and version support each setting.
- Monitor profile deployment and device status after assignment.
Windows 11, version 26H2 security baseline
Windows 11 version 26H2 security baseline will also be made available shortly in Intune. We are validating the final recommendations and plan to make
the updated baseline available over the coming days following the Windows 11, version 26H2 release.
The current baseline includes:
- A new recommendation for Configure Windows Ready Print driver ranking.
- An updated Turn off encryption support recommendation that changes the supported Transport Layer Security versions from TLS 1.1 and 1.2 to TLS 1.2 and 1.3.
- Configure NetBIOS settings - This setting is pending availability in the settings catalog and will be added to the baseline in a future update.
Learn more
- Create a policy using settings catalog in Microsoft Intune
- Windows 11 - release information
- Learn about Intune security baselines for Windows devices
We welcome your feedback. If you have questions about these settings or Windows 11, version 26H2 management in Intune, leave a comment on this post or follow us on LinkedIn or @MSIntune and @IntuneSuppTeam on X to continue the conversation.
Post updates:
10/06/26: The Windows security baseline for Windows 11, version 26H2 is now available in Microsoft Intune. We’ve also updated this post with the Settings Catalog additions introduced as part of Windows 11, version 26H2 support.
