Intune policiesas a template.Every device to the same standard.
Define compliance, antivirus, encryption and app protection once and set them up the same way in every Microsoft 365 tenant. Conbool 365 Tenants shows where a tenant deviates and rolls out the policies once you approve.
Why devices are set up differently in every tenant
Intune can do a lot. It is rarely set up the same way.
Every tenant by hand
Compliance, endpoint security, update rings and app protection live in different areas of Intune. With thirty customers that means the same steps thirty times.
Compliance alone does not protect
Marking a device as non-compliant does not block anyone. Only a Conditional Access policy turns it into protection, and that is often missing.
Deviations go unnoticed
An update ring is postponed for a project, BitLocker switched off on one device. Without comparison nobody notices.
The fear of downtime
A wrong rule for removable storage or attack surface hits every workstation. That is why much stays at the defaults.
From template to configured device
Choose, compare, roll out after approval.
1. Choose entries
Tick the Intune entries that fit from the library Conbool hardened. None is preselected because each one affects devices.
2. Compare every tenant
365 Tenants reads the policies in Intune and shows field by field what is missing or different. Stricter values remain and do not count as deviations.
3. Roll out with a dry run
The plan shows every policy before it is written. Rollout happens only after approval, then every value is verified.
What the Intune entries cover
Nineteen optional entries for Windows, macOS, iOS and Android.
Compliance per platform
Windows with BitLocker, Secure Boot, TPM, firewall and antivirus. macOS, iOS and Android with passcode, encryption and protection against tampered devices.
Antivirus and attack surface
Microsoft Defender Antivirus with real-time and cloud protection. The rules against attacks through macros and scripts first only report what they would block.
Encryption and credentials
BitLocker with the key in Entra ID, Credential Guard and a separate local administrator password per device.
Firewall, SmartScreen and lock
Firewall in all profiles, checks on downloaded programs, lock after inactivity and USB storage read-only.
Updates for Windows
An update ring with fixed deadlines for security updates, so no device falls months behind.
App protection on phones
Company data stays in Outlook, Teams and Office, with its own PIN. The administrator chooses the group of users in Intune.
Intune with a template and Intune by hand
The policies are the same. The difference lies in comparison and evidence.
Conbool 365 Tenants | Manual setup | |
|---|---|---|
| Basis | Versioned template, the same for every tenant | Created anew per tenant |
| Implementation | Dry run, approval, then every value verified | Steps in several areas of Intune |
| Deviations | Regular snapshot, deviation per field | Noticed at the next review |
| Blocking access | Compliance and Conditional Access in the same template, enforced only after evaluation | Set up separately, often without evaluation |
| Licence | Without Intune nothing is written or counted as a deviation | Errors only when saving |
| Many tenants | Distribute from the partner portal to many tenants | Every tenant a project of its own |
As of October 2026. The right-hand column describes the usual approach without a tool, not a specific vendor.
FAQ on Intune security policies
Which areas of Intune does 365 Tenants cover?
Is a device blocked after rollout?
Who do the policies apply to?
Can a run be undone?
Which licence and which permissions does the tenant need?
Does this replace the security baselines in Intune?
Related solutions
365 Tenants
Define security settings as a template and roll them out to every tenant.
Microsoft 365 security baseline
One secure state for every tenant, with comparison and dry run.
Conditional Access templates
Conditional Access with report-only mode and checked break-glass accounts.
Secure Teams settings
External access and meetings as a template.
Microsoft 365 security check
Tenant settings and sharing in one report.
365 Permissions
Who can access what in SharePoint, OneDrive and Teams.
Entra ID Backup
Back up the users, groups and policies of the directory.
Every device in every tenant to the same standard.
Choose Intune policies, compare, roll out safely.