Microsoft Intune

Section 4 of the CIS Microsoft 365 Foundations Benchmark v7.0.0 covers Microsoft Intune, configured in the Microsoft Intune admin center. It is the smallest section in the benchmark, with 2 controls out of 160, and both are Level 1 in the E3 profile. Small does not mean minor: these two settings decide which devices your tenant is willing to treat as trustworthy.

Control 4.1, in the compliance policy subsection, says devices with no compliance policy should be marked not compliant. The theme is the gap left by devices that nobody has evaluated: if a device with no policy is not treated as non-compliant, rules that depend on device compliance have nothing to stop it. Marking such devices not compliant removes that gap.

Control 4.2, in the enrollment restrictions subsection, says enrollment of personally owned devices should be blocked. The theme is control over what joins your management boundary: blocking personal enrollment keeps personally owned phones and computers out of your managed fleet unless you decide otherwise.

With only two controls, this section is quick to review, but changing either setting can affect many people. Devices without a policy may start to show as non-compliant, and staff who use personal devices may no longer be able to enrol them. Check who is affected before you change either one.

How ConfigCobra assesses it. ConfigCobra reads your tenant through read-only Microsoft Graph permissions, with no agents and no admin password sharing, and never changes a setting. A scan returns a result for both controls, each with a severity estimate that ConfigCobra uses to prioritise remediation (CIS itself publishes no severity). Each failing control comes with a copy-paste remediation script or admin portal steps. Remediation impact analysis lists the affected users, groups, mailboxes, apps and policies, with an impact level of High, Medium, Low or None, so you can see the effect before you apply the fix. The inventory also includes devices, with built-in risk views for unmanaged and non-compliant devices. Every connected cloud is scanned automatically every day, an ad hoc scan can be started at any time, and drift detection alerts you by email if either control regresses.