Edge security baseline and all other security baselines

[GianlucaSB]

Hello all,

I say sorry in advance for this stupid question and by having asked it in a new conversation.

I want to know why on Intune we have the possibility to configure devices with those security baselines AND/OR with the (almost?) same settings on Device configuration profiles.

I mean, why? Two places? Would it be better to just have Security baselines settings or just Device configuration settings? This is confusing and in my company we realize that both are doing the job... or one settings is set to enabled on one side, then disabled on the other side.

Please consider closing this thread only when a proper answer is given.

Thank you!

Gianluca

[#2]

@GianlucaSB 

Security baselines are designed with MSFT best practice configuration by default. Our device configuration profiles are all not configured by default.

you can use the baselines as a starting point, and supplement them with your own individual settings based on your business needs.

All of the settings in our security baselines are also available in the device configuration profiles – we’ve just pulled together the most important and preconfigured them.

[#3]

Ok, but still having Windows Hello for Business in 3 different places (Baseline, configuration profiles and Enrollment) it just creates confusion. Same for other settings, and it is not clear who overpowers who in case of some settings that are applied in two or more different places at the same time.

Cheers,
Gianluca

[#4]

@GianlucaSB feedback noted.  We will see what we can do in future updates.  I would also suggest getting this posted over on the Intune side as they dont monitor this channel and actually have their own baseline.  They just consume the settings from us.

[#5]

Hello,

please do so!

Thanks,
GianlucaSB