Introducing Intune Baseline Comparison
Security baselines are easy to compare on paper. In practice, the same Windows setting can appear under different identifiers, names and value formats — making a simple one-to-one comparison surprisingly unreliable.
JNL Group’s Intune Baseline Comparison is built to make that comparison transparent.
The first release compares OpenIntuneBaseline v3.8 with Microsoft’s Windows Security Baseline 25H2, from overall coverage down to the evidence behind an individual setting.
v1 at a glance
Microsoft’s 25H2 baseline contains 482 settings. The normalized OIB dataset contains 1,350 unique settings.
Today, 120 Microsoft baseline settings have both a verified identity and enough public evidence to compare their configured values.
The 24.9% verified coverage figure is intentionally conservative. It does not mean OIB only covers 24.9% of Microsoft’s baseline. Another 215 settings already have an established OIB counterpart, but remain Unconfirmed because the available public evidence is not yet sufficient to prove whether their configured values are equivalent or different.
Rather than guessing, the comparison leaves them Unconfirmed.
What does “Different” actually mean?
Both records can be deterministically identified as the same Windows policy, and Microsoft’s public policy metadata defines the semantics of the underlying values.
That makes this a verified configuration difference rather than a difference inferred from names or labels.
Different does not mean insecure. It simply means the two baselines intentionally configure the same setting differently.
Identity before values
The comparison answers two questions in order:
- Is it the same Windows setting?
- If it is, are the configured values equivalent?
Stable setting identifiers, documented CSP paths, Microsoft DDF metadata and other authoritative public identifiers are used to establish identity.
Display-name similarity can identify a possible candidate, but it cannot create a verified match by itself.
Only after identity is established are configured values compared.
This distinction matters because raw values such as 1, true or _1 do not have a universal meaning. Their semantics depend on the individual Windows policy.
A result only becomes Same or Different when both identity and value semantics can be supported by reproducible evidence.
Otherwise, it remains Unconfirmed.
The comparison also keeps configured values separate from Windows default or effective behavior. Not Configured is not automatically interpreted as Disabled or assigned another assumed value.
Public and traceable
The tool is built entirely from public source material, including:
- Microsoft’s Windows Security Baseline documentation
- Microsoft CSP and DDF metadata
- official Microsoft security documentation
- the public OpenIntuneBaseline repository
No Intune tenant connection is required.
There are no runtime Microsoft Graph calls and no tenant credentials to provide.
Source versions, hashes and provenance are retained, while the public site receives generated static HTML, JSON and CSV data.
Updates without silent changes
Microsoft, OIB and the supporting Microsoft metadata are checked regularly for upstream changes.
New source data is validated before it can affect the public comparison. Unexpected structures, implausible counts, ambiguous mappings or changed evidence fail closed and leave the last-known-good dataset in place.
Valid changes create a reviewable candidate rather than silently publishing new classifications.
This is intentional: the goal is not to maximize the number of matches, but to make a clear distinction between what can be verified and what cannot yet be proven.