Security baselines

[Aragorn]

I'm testing the security baseline profiles for deploying to our Windows 10 devices. I'm finding it quite tedious to try and consolidate settings between baseline policies and other configuration policies in Intune. There are duplicate settings between policies and also there are settings in config policies which are missing in baseline polices. Is there any guidance or tips how this can be done more efficiently? Also how do these get applied if there are duplicate policies, what is the logic? 

[#2]

Hey @Aragorn,

good planning and creation of no duplicate settings, as these will result in conflicts. Configuration profile conflict settings are not applied at all, manually resolve them and make sure only one config profile configures your setting.

If multiple policies are assigned to the same user or device, how do I know which settings gets applied?

When two or more policies are assigned to the same user or device, then the setting that applies happens at the individual setting level:

• Compliance policy settings always have precedence over configuration profile settings.

• If a compliance policy evaluates against the same setting in another compliance policy, then the most restrictive compliance policy setting applies.

• If a configuration policy setting conflicts with a setting in another configuration policy, this conflict is shown in Intune. Manually resolve these conflicts.

https://docs.microsoft.com/en-us/mem/intune/configuration/device-profile-troubleshoot#what-actions-c...

best,

Oliver