CIS Compliance (older page)
This is the older page. Compliance in the sidebar opens the new Compliance page, which scores CIS v5, the Essential Eight and Microsoft baselines, with In policy and On devices for each control. To reach this older page, open More › Old CIS page on the Compliance page. Back to the new Compliance page at the top returns you.
The CIS Compliance page checks every tenant against 490 rules and scores the result. The scan runs automatically after each successful Intune collection, so the score reflects the policies MDO collected most recently.
The rules
Section titled “The rules”| Source | Rules |
|---|---|
| CIS Microsoft Intune for Windows 11 benchmark (v4) | 457 |
| CIS Microsoft 365 benchmark | 2 |
| MDO best-practice checks | 31 |
By category:
| Category | Rules |
|---|---|
| Endpoint Configuration | 330 |
| Endpoint Security | 127 |
| Device Management | 29 |
| Identity & Access | 4 |
Each rule is evaluated against the policy data MDO already collected. A scan makes no Microsoft Graph calls. The Identity & Access rules read a snapshot of Entra settings taken during the collection.
Score header
Section titled “Score header”The CIS Compliance page (Compliance › More › Old CIS page) shows:
- Compliance percentage: passed rules divided by rules that passed, failed or returned a warning.
- Risk score: failures weighted by severity (Critical 10, High 5, Medium 2, Low 1, with a warning counting half).
- When the last scan ran.
Admins can also start a scan by hand with Run Scan.
Reading findings
Section titled “Reading findings”Each finding shows the rule, its severity, its result and the framework controls it maps to. Results include pass, fail, warning, not evaluated, no matching policy, manual check, not set, not applicable and risk accepted.
Filter the list by result, severity and CIS profile (L1 or L2). You can also set a target (CIS L1, CIS L2, all CIS rules, NIST, CMMC or HIPAA) to narrow the default view to the rules that matter for it.
Open a finding to see the evidence: the result message, what MDO found, the value it expected and the mapped controls.
Framework mappings
Section titled “Framework mappings”Rules map to controls in 12 frameworks:
| Framework | Mappings |
|---|---|
| NIST SP 800-53 | 1,043 |
| CMMC Level 2 | 660 |
| HIPAA | 654 |
| NIST CSF 2.0 | 624 |
| ISO 27001 | 576 |
| CIS Controls v8 | 491 |
| Zero Trust | 457 |
| MITRE ATT&CK | 389 |
| PCI DSS | 387 |
| Cyber Essentials | 384 |
| SOC 2 | 381 |
| Essential Eight | 376 |
Accepting a risk or marking a rule not applicable
Section titled “Accepting a risk or marking a rule not applicable”Admins can act on failed rules and warnings from the row menu:
- Accept Risk: you have reviewed the gap and accept it. MDO records who did it, when, and an optional note.
- Mark Not Applicable: the rule doesn’t apply to this tenant.
- Reset: clears the override so the rule scores normally again.
Overrides stay in place through later scans. MDO keeps evaluating the rule underneath the override.
Scan failures
Section titled “Scan failures”A scan failure doesn’t fail the collection it follows. The collection finishes and the scan error is logged.