CIS Windows 11 Intune L1

CIS Windows 11 Intune L1

A Maester Pack that checks your Intune policies against the Level 1 recommendations of the CIS Microsoft Intune for Windows 11 Benchmark v5.0.0. One test per setting; tests are numbered in the order they were added (MP.JL.CISW11INT.L1.001), and each test's description names its CIS recommendation.

The tests read policy configuration (a policy exists, is assigned and has the value), not whether devices applied it.

Install and run

Install-MtPack Pacers31Colts18/maester-packs-joeloveless/cis-win11-intune-l1
Connect-Maester
Invoke-Maester -Pack JL.CISW11INT.L1

Maester's default Graph scopes include what the pack reads (DeviceManagementConfiguration.Read.All, and GroupMember.Read.All to show group names).

If not useing Connect-Maester, you can use Connect-MgGraph to an Application Registration with the proper permissions:

DeviceManagementConfiguration.Read.All GroupMember.Read.All

How a setting test decides

A test passes when at least one assigned policy sets the setting as the recommendation requires and no other assigned policy sets it to something else. What a test checks is in its parameters, with the recommendation's values as defaults (Get-MtTest -Path ./cis-win11-intune-l1 | Select-Object -ExpandProperty Parameters lists them):

Changing Source, Platform, SettingDefinitionId or Expected in the config changes what the test checks; the result row records that the value came from Config. Set a filter for every test at once with GlobalSettings, or tune one test with TestSettings, in maester-config.json:

{
  "GlobalSettings": { "JLIntune.PolicyNameFilter": "W11-CIS-*" },
  "TestSettings": [
    { "Id": "MP.JL.CISW11INT.L1.001", "Parameters": { "AllowConflicts": true } }
  ]
}

Moving to a new benchmark version

The benchmark's name and version are set in one place: tests/frameworks/cis-intune-win11-l1.json (Name, Version). Maester writes that version on every result row.

1. Change Version in the framework file.
2. Run ./tools/Test-Pack.ps1. It fails and lists each text that still names the old version (the manifest Description, the guide Summary, this README and the repository README). Update them.
3. Update the tests whose recommendations changed, and the Requirements in the framework file: add new recommendation IDs, remove withdrawn ones.
4. Bump Version in maester-pack.json and add a ## cis-win11-intune-l1 <version> entry to CHANGELOG.md.

The pack's Code and test IDs stay the same, so Update-MtPack moves everyone to the new release.

Tests