Security Baseline Preview now live!

[Intune_Support_Team]

Security baselines is now live in Preview. You can navigate to security baselines if you are using Device Management: https://devicemanagement.microsoft.com: 

Or you can see Security baselines (Preview) in https://ms.portal.azure.com/#blade/Microsoft_Intune_Workflows/SecurityBaselineMenu/securityBaselines. The UI (as of 1/30/18 - 8 PM for portal.azure.com is still rolling out the final UI, so it's not viewable yet in the left hand navigation):

 

Try it out; give us your feedback!

Are you seeing the following screen shot when you land on security baselines? We’re glad you’re excited for security baselines – we are too! We anticipate all customers will have the public preview by the end of January. If you did see the security baselines, know that we shared it a little too early, so we’ve dialed it back just a touch to ensure your settings work as expected. When the new feature is available, you will no longer see this page and we will be ready for you to try it out in preview.

You will be able to configure security baselines from Device Management or through Azure. If you have any questions, as always, comment back on this post or contact us directly through this forum.

Blog updates:

• Updated 1/30/2019 with preview availability.

[mtolvanen]

Yesterday we configured this MDM Security Baseline to use and it assigned to some computers for testing. Now we can't anymore modify settings or take this assignment away. What we should do?

[Intune_Support_Team]

Just direct messaged instructions your way! (Look for the envelope icon on the top of your screen for the message location). 

[Chaithanya Sarabuddi]

Can you forward me steps to edit or delete these policies..?

[Intune_Support_Team]

@Chaithanya Sarabuddi if you enabled them while they were available through Intune, just respond back with a yes and we can direct message you to get your tenant information (please don't include it below - everyone can see this page!). Please keep in mind, there's other ways to enable Security Baselines too - through Group Policy, through ConfigMgr, etc. So let us know if you're specifically looking at Intune-enabled security baselines. 

[mtolvanen]

Hello @Intune_Support_Team it seems that our tenant where you previously enabled Security Baselines (private preview) and now when Security Baselines are public preview something happens to our previously created profiles.. Because all our previously created profiles just disappeared under Security Baselines.. Profiles seems to be still assigned to our computers but situation is same than before that I can't see settings or can't take assignments away. Is there something you could do? 

[Intune_Support_Team]

@mtolvanen assuming this is all test you can delete the group and that will get rid of the profile. If you can't delete the group, just let us know. In the transition from private => public preview they didn't keep a way in the UI to delete the old policies although they will for public => GA.  We do have a back way (graph) of deleting them - you can call the graph and tell it to delete. Let us know although I'd give it a little big longer to completely wrap up the deployment. 

[Intune_Support_Team]

@mtolvanen private messaging you the link for how to access the preview profiles! If anyone else needs it, just let me know!

[memememm-31945]

Hello. Why can't I see /access this? all I see is a blank page in Azure, and in MDM there is just the rain cloud, this has been this way since around Wednesday Thursday last week. I am global admins and I have also added myself to the "Policy and Profile Manager" built-in role, but it makes no difference

[Intune_Support_Team]

@memememm-31945  I just checked on several different tenants and I see security baselines just fine. Note a couple of general troubleshooting access items: 1) Are you using one of the browsers that can administer Azure? 2) Have you tried closing and reopening your browser? 3) Do you have an Intune license assigned to your admin account? 4) Did you try accessing it with an InPrivate setting just to make sure there's no cached credentials? 5) Did you try removing the policy and profile manager and just keeping the Global Admin designation? If none of the above resolve this, then definitely contact support to open a ticket. Again, I tried on several different tenants and see it just fine. Hoepfully this helps. Keep us posted!

[memememm-31945]

It never worked through IE, I had closed and opened the browser many times (Taskkill as it happens) it worked on Chrome, but I noticed it is unavailable again just over the weekend, no change to my access (not that i am aware of) yet I am now getting access denied, unauthorised messages, etc. Thanks for your help though.

[Intune_Support_Team]

@memememm-31945 there is an active advisory right now  - IT178500. You can see the incident writeup on your Tenant Status blade in portal.azure.com where we bring over the service health dashboard posts or you can see it at portal.office.com under service health. 

[Mark Lewis]

Hi there, just looking through my intune portal and noticed that the Preview prefix has been dropped from the Defender ATP baseline, have these gone GA now? Thanks

[memememm-31945]

I want to know when 1903 is going to show up in Intune portal; or is it not named to match the release? I see it is now just listed as published 2 / 1 / 2019 which doesn't match 1809 or 1903 or am I mistaken here?

[memememm-31945]

Disregard my comment above, as I clicked onto the Security baseline, I can now see version information.

[memememm-31945]

@Mark Lewis, The "preview" prefix is still there it is now just in the version information

[Mark Lewis]

OK, so experimenting with the WD ATP Baseline and found a small issue.

We already have a profile for configuring Identity Protection (Windows Hello). The setting Configure Windows Hello for Business is always in conflict, despite being the same.

Profile setting = Enable (Disbaled/Not Configured as alternative options)

Baseline setting = Yes (Not configured as alternative option)

Appreciate you should probably use one or the other but not both, but like I say, I am playing around with this.

[Mark Lewis]

@memememm-31945  https://docs.microsoft.com/en-us/intune/whats-new#the-security-baselines-feature-is-now-generally-av...

The Security Baselines feature is now generally available
The Security Baselines feature is out of preview and is now generally available (GA). This means the features is ready for use in production. However, the individual baseline templates can remain in preview and are evaluated and released to GA on their own schedules.

The MDM Security Baseline template is now generally available
The MDM Security Baseline template has moved out of preview and is now generally available (GA). The GA template is identified as MDM Security Baseline for Spring 2019 Update (19H1). This is a new template and not an upgrade from the preview version. As a new template, you’ll need to review the settings it contains, and then create new profiles to deploy the template to your device. Other security baseline templates can remain in preview. For a list of available baselines, see Available security baselines.

In addition to being a new template, the MDM Security Baseline for Spring 2019 Update (19H1) template includes the two settings that we recently announced in our In Development topic:

Above Lock: Voice activate apps from a locked screen
DeviceGuard: Use virtualization-based security (VBS) at the next reboot of devices.
The MDM Security Baseline for Spring 2019 Update (19H1) also includes the addition of several new settings, the removal of others, and a revision of the default value of one setting. For a detailed list of the changes from Preview to GA, see What’s changed in the new template.

[mtolvanen]

Hello @Intune_Support_Team this happened again :( Could you provide link by private message where I could delete old Security Baseline preview assignments?  

--

It seems that our tenant where you previously enabled Security Baselines (private preview) and now when Security Baselines are public preview something happens to our previously created profiles.. Because all our previously created profiles just disappeared under Security Baselines.. Profiles seems to be still assigned to our computers but situation is same than before that I can't see settings or can't take assignments away. Is there something you could do?