Compliance
Know where each tenant stands against CIS and the Essential Eight
A control-by-control score from the policies already in Intune, with the evidence an auditor asks for.
You don't have to deploy anything to get a score, and there's no agent to install. MDO reads the policies it already collects from your tenant and checks them against the standard you choose.
The evidence behind each control
When an auditor asks how a control is met, you can show them. In policy names the policy that sets the control, the value it sets, and who it's assigned to, including any assignment filter. From there you open the policy in MDO's viewer or in Intune.
On devices says how many in-scope devices Intune reports the policy was delivered to, and how many show a conflict, an error or no report yet.
That number is Intune's delivery report. MDO doesn't read the setting on the device, and the page says so beside the number. Device results refresh with the nightly collection or when an admin clicks Scan now.
The standards
CIS Microsoft Intune for Windows 11 v5.0.0
Level 1, Level 2 (which includes Level 1) and BitLocker, each with two scores. Strict counts every rule as CIS wrote it. MDO Hardening counts the rules where MDO deliberately deviates, for example to keep Autopilot working, as met. You see the benchmark's view and your practical view side by side, and every deviation stays visible.
Essential Eight
The Australian Signals Directorate's framework, used well beyond Australia. MDO scores Maturity Levels 1 to 3 the way the ASD does: a level per strategy, not a percentage. It assesses the six strategies Intune configures. Multi-factor authentication and backups are outside what Intune holds, so they're listed as not checked. For Office macros and user application hardening, the page notes that the levels haven't yet been confirmed against the ASD's mapping.
Microsoft security baselines
Windows 25H2, Defender for Endpoint 24H1, Edge 139 and Microsoft 365 Apps 2512. The controls are checked now. A score for each baseline comes in a later release.
Each state tells you what to do
Every control gets one state, worked out from the policies and their assignments.
- Enforced
- An assigned policy sets the right value for everyone in scope. Nothing to do.
- Partial
- The right value, but some devices miss out because of the groups, exclusions or filters. Widen the assignment.
- Staged
- The right value sits in a policy that isn't assigned. Assign it when you're ready.
- Wrong value
- An assigned policy sets a value that doesn't meet the control. Change the setting, or record an exception.
- Conflicting
- Two policies that can reach the same devices set different values. Pick one and remove the other.
- Not configured
- No assigned policy sets it. Add the setting, or deploy a baseline that does.
- Accepted deviation
- MDO deliberately departs from the benchmark here, usually so Autopilot keeps working. Shown, never hidden.
- Manual
- Intune can't show it. Check it by hand and attest to the result.
Scope, exceptions and attestation
Score the devices that matter. By default MDO scores the corporate Windows devices Intune manages. In Settings › Compliance scope you can narrow that to an Entra group or an assignment filter. Every score states its scope, for example "CIS v5 L1 on 42 corporate Windows devices".
Some controls you'll decide not to meet. An exception records why: it needs a reason and an approver, and expires after 12 months by default, or on a date you set. The strict score still counts it as not met, so an auditor sees the real picture, and a second figure shows your score with exceptions.
Attestation covers Manual controls: an admin marks one met or not met with a note or a link to evidence, and MDO asks again after 90 days. Exceptions and attestation are for Admins and Owners.
For the auditor, and for you
- Download CSV and a Printable view to hand to an auditor or a client.
- For the change side of an audit, Audit › Reports lists every change by period, area and person, as CSV or PDF.
- A 90-day trend for each score, so you can show progress.
- A Not checked by MDO tab listing the controls MDO can't see, so the gap is visible.
- A Hygiene tab with 33 tenant checks that aren't part of any standard and aren't scored.
- From Intune › Devices, one device's compliance across the controls.
The older CIS Compliance page is still there, under More › Old CIS page. How MDO treats your tenant explains what MDO reads and keeps.
Read the compliance docsFree during the private beta. Tell us about your tenant and Aaron will get back to you.