Your Windows 11 25H2 Baseline in Intune Won't Update Itself
Intune shipped the Windows 11 25H2 security baseline, but existing 24H2 profiles do not upgrade automatically. Here is what MSPs should check across their tenant portfolio before assuming every customer is on the current baseline.
A baseline that doesn't update itself
Microsoft shipped the Windows 11, version 25H2 security baseline in Intune this year, replacing the 24H2 baseline as the current recommended configuration. It closes off SMBv1, strengthens credential protection with Credential Guard, tightens SmartScreen and exploit protection, and controls which devices and drivers can be installed on managed endpoints.
Here is the part that catches tenants out: existing 24H2 baseline profiles did not automatically move to 25H2. They became read only. Nothing breaks, but nothing improves either, until an admin explicitly creates a new 25H2 profile or upgrades the existing one. A tenant can sit on a stale, unmaintained baseline indefinitely and look perfectly fine in the console.
It gets more granular from there. A setting to disable Internet Explorer 11 launches via COM automation was left out of the 25H2 baseline at first release because of a known issue, then added back in a later service update once the issue was resolved. So even two tenants both running a 25H2 profile can differ, depending on when that profile was created or last reviewed.
What to check across your tenants
- Which Windows security baseline version is actually assigned in each tenant, not just whether one exists
- Whether any tenant is still running a read only 24H2 profile that needs to be explicitly upgraded
- Whether baseline settings added after initial release have been reviewed and applied, rather than assuming a baseline created months ago is current
The takeaway
Security baselines are not set once and left alone, even when Microsoft is the one maintaining the content. Someone still has to press upgrade, in every tenant, every time. Do you know which of your tenants are still running last year's baseline?