Microsoft has published the Windows 11 version 25H2 security baseline for Intune, and there is one thing every admin needs to know before anything else: your existing baseline profiles will not update automatically. The new version is available in the console, but nothing changes on your devices until you take deliberate action. If you have been running the 24H2 or 23H2 baseline, those profiles continue to apply their original settings. The 25H2 settings, including new controls and updated defaults, do not land until you migrate.
This post covers what changed in the 25H2 baseline, a specific known issue you need to be aware of, how to find your current profiles, and a step-by-step path to migrating — including when to rebuild from scratch versus migrating in-place.
What changed in the 25H2 baseline
Every new baseline version contains three categories of change. Understanding which category a setting falls into determines what you need to do during migration.
| Change type | What it means | Migration action |
|---|---|---|
| New settings | Controls that did not exist in earlier baselines | Review each one — decide whether to keep Microsoft's recommended value or customise |
| Updated defaults | Settings that existed before but Microsoft changed the recommended value | Do not assume your old value carries over — the new default applies unless you explicitly override it |
| Retired settings | Settings removed from the baseline (deprecated OS feature, superseded control) | Identify whether you relied on these and replace or remove them from your configuration |
The full list of settings for the Windows 11 25H2 baseline is in the Windows MDM security baseline settings reference on Microsoft Docs. Use it to do a side-by-side comparison with your current profile configuration before migrating.
Known issue: IE11 COM automation setting was missing at launch
There is a specific issue with the 25H2 baseline that you need to check if you created a profile before the June 2026 Intune service update.
At initial release of the Windows 11 25H2 baseline, the setting "Disable Internet Explorer 11 launch via COM automation" was missing from the profile. Microsoft confirmed this and added the setting in the June 2026 Intune service update.
What the setting does
This setting prevents applications from silently launching Internet Explorer 11 through COM automation interfaces. IE11 is end-of-life and its COM hosting surface is a known attack vector — scripts or legacy applications can invoke it to bypass modern browser security controls. Disabling COM-based IE11 launch is a standard hardening control in enterprise environments.
How to fix it
If your profile was created before the June 2026 service update, the fix is straightforward: open the profile in Intune, make any edit (or simply open and save without changes), and save it. This triggers Intune to re-evaluate the profile definition and pull in the now-present IE11 COM setting with its recommended value.
- Go to Intune admin centre > Endpoint security > Security baselines > Windows 11 Security Baseline
- Open the affected profile
- Click Edit
- Navigate through the steps (no changes needed) and click Save
- Intune will re-process the profile with the IE11 COM setting now included
How to find your current baseline profiles
Security baseline profiles in Intune are under Endpoint security, not the Devices blade. Here is where to look:
Intune admin centre
└─ Endpoint security
└─ Security baselines
├─ Windows 11 Security Baseline ← your profiles are here
├─ Windows 365 Security Baseline
└─ Microsoft Defender for Endpoint BaselineUnder Windows 11 Security Baseline, select the tile and you will see all profiles currently assigned in your tenant. Each profile shows:
- Baseline version — which version the profile is currently targeting (e.g., Windows 11 24H2)
- Assigned groups — which device groups are receiving this profile
- Profile status — how many devices are succeeded, pending, conflicted, or errored
Any profile showing a version earlier than Windows 11 25H2 is a candidate for migration.
Migration options: new profile vs in-place migration
There are two approaches to moving your devices onto the 25H2 baseline. The right choice depends on whether you need to preserve your existing customisations.
| Approach | When to use | Trade-off |
|---|---|---|
| Option A — New profile | You want a clean start; your existing profile has accumulated drift or unclear customisations | Cleanest result — you review every setting intentionally. More time upfront. |
| Option B — In-place migration | You have a well-documented existing profile with specific customisations you want to carry forward | Faster — Intune carries your customisations forward, but you must still review changed defaults and new settings. |
Whichever option you choose, test with a pilot group before deploying to your full device estate. See the testing section below.
Step-by-step migration guide
New: STIG audit baseline
Alongside the 25H2 security baseline, Microsoft also released a STIG audit baseline for Windows 11 in Intune. This is a separate, distinct baseline — it is audit-only, not enforcement.
| Property | Detail |
|---|---|
| Benchmark | DISA STIG SCAP Benchmark Version 2, Release 7 |
| Benchmark date | January 5, 2026 |
| Mode | Audit only — assesses compliance, does not enforce or change settings |
| Who should use it | Organisations subject to DISA STIG compliance requirements (US government, defence contractors, regulated industries that align to STIG) |
The STIG audit baseline does not replace the Windows 11 25H2 security baseline — they serve different purposes. The 25H2 baseline is your enforcement layer. The STIG audit baseline runs alongside it to report on DISA STIG compliance posture without making changes to device configuration.
Test before you roll out
Security baselines can have unexpected interactions with line-of-business applications, legacy configurations, or other Intune policies already deployed in your environment. Do not deploy directly to your full device estate.
A practical pilot approach:
- Pilot group — IT team or a test ring (20–50 devices). Deploy the new 25H2 profile here first. Run for 24–48 hours minimum.
- Check device status in Intune. Look for Error or Conflict states under the profile's device status view.
- Validate key applications — anything that might be sensitive to security policy changes: browsers, VPN clients, legacy LOB applications.
- Check for conflicts — go to Endpoint security > Security baselines > your profile > Per-setting status. Any setting showing Conflict is being overridden by another policy. Decide which policy should win.
- Expand scope once the pilot is clean. Move to a broader ring before full deployment.