Daily Intune News
Aboutmerill.net
Microsoft Intune
Device security

Stig Audit Baseline

30 October 2026Feature updateAction required+23 / −32 lines

In brief

The STIG audit baseline is documented as available in commercial and GCC High environments. The update adds a View Reports role permission requirement, clarifies that audit-only profiles use Audit report, and updates initial reporting behavior and status meanings.

What Intune admins need to know

Ensure report viewers have Device configurations > View Reports permission. Expect initial results after 24 hours or longer, and interpret an early Error as potentially temporary data-retrieval failure rather than a failed check.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

feedback_system: Standard ms.service: microsoft-intune manager: laurawi author: lenewsadaanavath ms.author: lanewsadaanavath ms.collection:

  • M365-identity-device-management
  • sub-secure-endpoints ms.reviewer: aanavath ms.subservice: protect description: Learn how to use the Security Technical Implementation Guide security baseline in Microsoft Intune to assess Windows device compliance against Security Technical Implementation Guide recommendations for Department of Defense organizations. ms.date: 2026-06-09T00:10-30T00:00:00.0000000Z ms.topic: how-to ai.ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1030 locale: en-us document_id: 93d0390c-d738-9569-a798-af9d6515b8fa document_version_independent_id: 93d0390c-d738-9569-a798-af9d6515b8fa Cloud requirements

Your organization must use a US Government Community Cloud High (GCC High) tenant. The STIG audit baseline isn'tis available in commercial cloud or GCCand US Government Community Cloud High (GCC High) environments.

Licensing requirements

The STIG audit baseline requires Intune Advanced Analytics.

This feature requires a subscription in addition to Microsoft Intune Plan 1 or Plan 2. For licensing options, see Microsoft Intune plans and pricing and Microsoft 365 Security Enterprise Plans.

Device platform requirements

The Endpoint Security Manager built-in role includes these permissions. You can also add them to a custom role.

To view STIG audit reports, your Intune role must also include the Device configurations > View Reports permission.

You also need scope tag permissions for the device groups you want to audit.

Create a STIG audit baseline profile

  1. On the Assignments tab, select the device groups that you want to audit against the STIG baseline. You can target all devices or specific groups.
  2. Review your settings on the Review + create tab, and then select Create.

After you create the profile and assign it to groups, Intune evaluates the targeted devices against the STIG baseline as devices check in. Audit report data begins to populate as devices report their assessment results. Initial audit results for newly targeted devices can take up to 24 hours or longer to appear.

During initial reporting, devices may temporarily show Error before audit results become available. An initial Error doesn't necessarily mean the device failed a benchmark check. Error can also indicate a problem retrieving the data needed for evaluation.

Review STIG audit results

After devices check in, you can review audit results through the Audit report view in the Intune admin center.

Screenshot showing the STIG audit baseline profile overview with device and user check-in status, Device assignment status report, and Audit report options in the Intune admin center.Note

For audit-only baselines, including STIG, the profile overview doesn't show Device and user check-in status, Device assignment status, or the standard Per setting status report. Use Audit report to review per-setting audit results and drill down into individual device results.

  1. Go to Endpoint security > Security baselines, and select Microsoft Windows 11 STIG SCAP Benchmark.
  2. Select the audit profile you want to review.
  3. Select Audit report to load the report view. You might need to select Generate the first time to begin populating data.

Device assignment status

The Device assignment status report shows all devices that the policy targets, including devices in a pending policy assignment state. Use this report to confirm which devices received the audit profile and to track assignment progress.

ColumnDescription
Device nameThe display name of the device as registered in Intune.
Last active userThe last user who signed in to the device.
Assignment statusThe current policy assignment state for the device.
Last report modification timeThe last time the device reported its assignment status.
Intune Device IDThe unique device identifier in Intune.
Microsoft Entra Device IDThe device's identifier in Microsoft Entra ID.
ModelThe hardware model of the device.
PlatformThe operating system platform of the device.
Entra User IDThe identifier of the associated user in Entra ID.

Audit report

The Audit report shows whether device values meet the recommended values for settings in the baseline version. This report provides a per-setting summary across all targeted devices, so you can quickly identify which STIG rules have the highest failure rates and prioritize remediation efforts. Each row represents a single STIG rule and shows how many devices passed, failed, or reported other statuses for that rule.

Select the device count for a rule, such as the number under Success devices, to open a detailed view for that rule. The drill-down view includes:

  • A summary bar that shows the count of devices in each status: PendingUnknown, Not applicable, SuccessPass, Fail, Error, and Conflict, and. Total. is the count of devices in the report, not an individual audit outcome.
  • A device list that shows the audit result for each targeted device. You can filter the list by status, search for specific devices, and export the results.

The device list includes the following columns:

Note

Policy IDs are tenant-specific and change when a tenant upgradesspecific. After upgrading to a new STIG version.version, retrieve the PolicyId for the profile you want to report on. For organizations that aggregate STIG audit data across multiple tenants, such as for the DISA Continuous Monitoring and Risk Scoring (CMRS) program, run this discovery call in each tenant to find the current PolicyId. Setting IDs are globally consistent across tenants for a given STIG template version, so you can correlate results across tenants by SettingId.

Retrieve the per-policy audit summary

| Pushes settings to devices | Yes | No | | Modifies device configuration | Yes | No | | Reports assessment status | Yes (delivery of policy) | Yes (on-device value assessment) | | Customizable settings | Yes | No (all rulessupported automated checks audited) | | Can conflict with other policies | Yes | No | | Available in commercial cloud | Yes | No (GCC High only)Yes | | Supports CSV export and Graph API | Yes | Yes | | XCCDF result mapping | N/A | Yes |

Known limitations

  • Audit-only — The STIG Audit baseline doesn't enforce or fix settings. Use Settings Catalog profiles for configuration.
  • No custom baselines — You can't upload custom STIG profiles. The baseline includesevaluates the full set of STIG rulessupported automated checks for the supported benchmark. Rules requiring manual verification must be assessed separately.
  • No actual device values — The Audit report shows the pass or fail result of each rule check, but it doesn't display the actual configuration value on the device.
  • Single baseline version — You can only use the latest supported baseline version to create new Audit profiles. You can't create profiles against older baseline versions. However, profiles you previously created with an older version remain available to run.
  • GCC High onlyCloud availability — The STIG Auditaudit baseline isn'tis available in commercial, GCC, or DoD cloudcommercial and GCC High environments.
  • UX-only profile creation — You must create STIG Audit profiles through the Intune admin center. API-based profile creation isn't supported.
  • Data latency — Audit data isn't real-time. There can be a delay of several hours between a device evaluation and the data appearing in the report. For details, see Data freshness.

Can I use the STIG Audit baseline in a commercial cloud tenant?

No.Yes. The STIG Auditaudit baseline is available only forin commercial and GCC High tenants.environments.

Can I customize which STIG rules are audited?

No. The STIG Audit baseline evaluates all rules in the supported benchmarkautomated checks as a single profile. You can't select a subset of ruleschecks for auditing. CAT I, CAT II, and CAT III ruleschecks are all included in a single baseline -the same profile; there are no separate profiles by severity category. Rules requiring manual verification must be assessed separately.

Does the STIG audit baseline conflict with other baselines or policies?

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…