Framework coverage

Compare Intune configuration evidence with native framework mappings or administrator-imported policy packs.

Frameworks compares your tenant’s Intune configuration with a framework, setting by setting. There are two workflows:

Native comparisons check your tenant against ten built-in technical mappings: NIST CSF 2.0, NIST SP 800-53 Rev. 5, NIST SP 800-171 Rev. 3 and Rev. 2, ASD Essential Eight, Cyber Essentials, ISO/IEC 27001:2022, SOC 2, BSI IT-Grundschutz and UK MOD Def Stan 05-138. They are read-only: nothing is imported and nothing is created in your tenant.
Policy-pack comparisons check your Settings Catalog policies against a versioned pack: the UK NCSC Device Security Guidance Windows pack, or a pack you import for Microsoft Security Baselines, DISA STIG or Custom Baselines. Except for the NCSC pack, which is comparison only, this workflow can also create the missing settings as new, unassigned policies.

The results are configuration findings, not an audit, a certification, an achieved maturity level or proof of compliance with the full framework. For how this differs from deploying Intune security baselines, see how to compare Intune with security frameworks.

OpenIntuneBaseline is not part of the framework catalog. It has its own OpenIntuneBaseline section in the sidebar, which deploys, compares and validates OIB policies. See OpenIntuneBaseline.

The framework catalog

Select Frameworks in the sidebar to open the catalog. It shows every framework as a card, grouped into framework comparisons, baselines and policy packs, and frameworks that are coming soon. The search box on the catalog filters by name, publisher or type. The sidebar lists each framework by name beneath Frameworks, except CIS Benchmarks, which has its own entry in the sidebar; use the arrow next to Frameworks to fold the list away. The catalog has sixteen entries:

Framework	Publisher	Type	Comparison source
Microsoft Security Baselines	Microsoft	Baseline	Import your own policy JSON
UK NCSC Device Security Guidance	UK National Cyber Security Centre	Baseline	2025 Windows Settings Catalog pack loads directly; comparison and reports only
CIS Benchmarks	Center for Internet Security	Benchmark	Delivered benchmark packs, Pro and MSP. See CIS Benchmarks
CIS Controls	Center for Internet Security	Control framework	Coming soon
NIST CSF 2.0	NIST	Control framework	Native comparison
NIST SP 800-53 Rev. 5	NIST	Control framework	Native comparison
NIST SP 800-171 Rev. 3	NIST	Control framework	Native comparison
DISA STIG	DISA	Benchmark	Import your own mappings
ASD Essential Eight	Australian Signals Directorate	Control framework	Native comparison, target maturity level 1 to 3
BSI IT-Grundschutz	BSI	Control framework	Native comparison
NIST SP 800-171 Rev. 2	NIST	Control framework	Native comparison
ISO/IEC 27001:2022	International Organization for Standardization / IEC	Control framework	Native comparison
SOC 2	AICPA	Control framework	Native comparison
UK MOD Def Stan 05-138	UK Ministry of Defence	Control framework	Native comparison of Issue 4, target cyber risk level 0 to 3
Cyber Essentials	NCSC	Control framework	Native comparison of v3.3
Custom Baselines	Your organization	Custom	Import your own policy JSON

UK NCSC Device Security Guidance loads its policy pack directly, and CIS Benchmarks loads benchmark packs from the TenuVault delivery service. For Microsoft Security Baselines, DISA STIG and Custom Baselines you supply reviewed Settings Catalog policy exports that map the framework to Intune. Native comparisons do not accept policy imports or create policies. The TenuVault installer does not include CIS benchmark text, CIS Build Kits or other restricted publisher content. Selecting a framework does not certify your mappings as official.

Native framework pages link to the publisher with Publisher reference. Policy-pack framework pages describe their source and coverage, and link to the publisher with Source.

What your plan includes

	Community	Pro	MSP
Compare with the UK NCSC Device Security Guidance Windows pack	Yes	Yes	Yes
Native framework comparisons	Yes	Yes	Yes
PDF reports and CSV or JSON exports (every framework except CIS Benchmarks)	Yes	Yes	Yes
Compare administrator-imported Microsoft, STIG or Custom packs	Yes	Yes	Yes
CIS Benchmarks assessments, remediation, PDF reports and CSV or JSON exports	No	Yes	Yes
Create missing settings from a policy-pack comparison	Yes	Yes	Yes

Non-CIS native comparisons, the UK NCSC Device Security Guidance pack, administrator-imported Microsoft, STIG and Custom comparisons, and their PDF, CSV and JSON reports are free in Community. CIS Benchmarks assessments, remediation and reports need Pro or MSP. CIS Controls is not available yet on any plan.

Every report and export is built on this device from the saved comparison or assessment, without reading the tenant again. It names the tenant, framework, version and profile, the assessed scope, the collection date, the supported coverage, what stayed unknown and the limitations, and states that it does not certify the tenant and does not prove device enforcement. Secrets, tokens and credentials are redacted. You choose where the file is saved; nothing is uploaded.

Compare your tenant with a native framework

Select the tenant in the sidebar, then open a native framework. The page header links to the publisher with Publisher reference. Expand About this comparison to read its scope, content license and limits.

1. Choose what to compare

In Compare your tenant:

Under Platforms in scope, toggle Windows, macOS, iOS / iPadOS, Android and Conditional Access. Select at least one.
On ASD Essential Eight, choose a Target maturity level. On UK MOD Def Stan 05-138, choose a Target cyber risk level.
Click Compare settings (Compare again for later runs).

TenuVault reads your Intune policies and compares them with the framework mapping. The comparison is read-only.

2. Follow the progress

While you stay on the page, the comparison fills it with its progress: the current step, for example “Reading settings catalog policies (1 of 12): 4 of 37 policies”, with the percentage and elapsed time. Click Cancel comparison there to stop it. Previous results stay underneath and come back unchanged if the comparison does not finish.

The comparison runs in the background, so you can keep using TenuVault:

While it runs, the Frameworks entry in the sidebar shows a spinner and the framework shows Comparing · N%.
When it finishes, a notification with View results appears in the app. If the TenuVault window is not in front, a system notification appears instead; click it to open the framework page.
Starting the same framework again for the same tenant while it runs shows the running comparison instead of starting a second one.

3. Review the results

From TenuVault 0.3.0, summary tiles count each capability once, using the best evidence from an assigned policy. Thirty policies that configure BitLocker still contribute one matching capability. Multiple properties for the same capability also contribute one vote. Unassigned policies remain visible in the evidence, but cannot count as matches:

Result	Meaning
Matches	Assigned policy evidence matches the capability. Required setting groups must be together on one policy.
Different	Assigned policy evidence is different and no complete assigned match was found.
Missing	No assigned policy provides the capability, or required setting groups are missing.
Unknown	TenuVault could not read the evidence, for example because a read failed or a value is masked. Governance scores use the same term and leave these results out of the score.
Outside scope	The capability applies to a platform you did not select, including Conditional Access when it is deselected.

Compliance policies, device restriction profiles and endpoint protection profiles return every on/off setting, and one left at Not configured reads as off. TenuVault ignores those, so they never count as Different or as evidence against a requirement. For example, a compliance policy that only requires the firewall is not reported as a different value for BitLocker or antivirus. Administrative template and custom (OMA-URI) settings are compared as set, because Disabled there is an explicit choice.

Click a tile to filter the capability list by its aggregate result. All observations for each capability remain visible, including different values and unassigned policies. Setting-by-setting evidence lists each check with its expected and observed values, the source policy and its assignment evidence. Use the search box and the result filter to narrow the list.

On Pro and MSP, the results also show the Baseline score of the comparison with its coverage, for example “9.6% on 96% coverage”, the same value as the card in Governance, and Partial collection when a policy type could not be read. A comparison scored under older rules shows “Scored under older rules. Compare again to score.” instead.

Below the evidence, expand Collection coverage and limitations, Framework references and Snapshot and ruleset provenance for the read status of each policy type, the framework requirements each check maps to, and the hashes that identify the input and ruleset. Policy types marked Not collected are not read for this comparison by design and are not a read gap.

Export the result as a PDF report, CSV or JSON. JSON and CSV contain the recognized evidence, not full policy snapshots. Masked or encrypted values are shown as unavailable; secrets are never recovered or exported.

The PDF report opens with a cover that shows the share of matching capabilities, the counts at a glance and the document control facts. A contents page with clickable entries and PDF bookmarks follows, then the summary, scope and limitations, the results overview, collection completeness, the evidence detail for every framework reference and the provenance and attribution page with the snapshot and ruleset hashes. Every page after the cover shows the report name, the tenant and Page X of Y. Pro and MSP can brand the report with their own name, logo and colors in Settings.

What native comparisons collect

TenuVault reads twelve policy types: Settings Catalog, legacy device configuration, administrative templates, classic and Settings Catalog compliance, endpoint security intents, app protection policies (three types), feature and quality update profiles, and, when selected, Conditional Access. App configuration, scripts and enrollment settings are not collected. A read that fails or is denied stays visible as a collection gap and is never reported as a match.

For both classic and Settings Catalog compliance policies, TenuVault collects scheduled actions and their grace periods. An assigned compliance requirement counts as matching only when a block action is present. An email-only action does not qualify; unavailable actions stay unknown. Marking a device noncompliant does not itself prove that Conditional Access blocks resource access.

Expected values are TenuVault’s interpretation unless a check identifies a publisher-prescribed value. A match does not prove that the setting is assigned to the right devices or enforced on them.

Per-capability score and the 0.3.0 reset

The native configuration score is matching capabilities / (matching + different + missing capabilities). Each capability contributes one vote using its best assigned evidence. Unknown capabilities stay out of the score and appear in coverage = evaluated / (evaluated + unknown). Outside scope capabilities are excluded. With no evaluated capability, there is no score.

This changes scores in 0.3.0. Earlier score and trend history is not comparable with the new results. Saved comparisons remain readable on the framework page, but current scores and trends start with comparisons collected under the new ruleset and detector version. Run Compare again to establish a new starting point.

When older history is present, the framework or scores page shows: “Compliance scoring changed in this version. Scores are now per capability and only count assigned policies, so they are not comparable with earlier history.” It is shown once: after it first appears, it does not repeat on other framework pages or the scores page. Dismissing it also saves the preference on this machine, shared across tenants.

The ruleset hash covers the selected framework, the capabilities it maps and an explicit detector version. Changes to unrelated frameworks do not reset this framework’s history. The selected platforms and profile remain separate comparison boundaries.

Comparison history

Comparison history keeps up to 20 comparisons per tenant and framework in protected local storage on this device. If protected storage is unavailable, history lasts for the current session only. When the history exceeds its storage limit, the oldest comparisons are removed automatically.

For each saved comparison you can:

View it. PDF, CSV and JSON exports of a saved comparison use the stored result and do not query the tenant.
Show changes since to list the setting observations that changed between that comparison and the one you are viewing, with before and after values, directly under the history. Only comparisons with the same scope and ruleset can be compared.
Delete it.

A comparison saved under an earlier detector version or framework mapping carries the label Scored under older rules. It stays readable but sets no baseline score; run Compare again to score the framework.

If saved comparisons for a framework cannot be read, TenuVault sets them aside and shows a notice. New comparisons are saved normally. Viewing history offline still requires a signed-in account and a valid local tenant entitlement.

Native history is separate from policy-pack workspaces.

Content and licensing

The native mappings are adapted from IntuneDocumentation under the Elastic License 2.0. The installed framework-NOTICES.txt contains the license and publisher attribution. Open material keeps its CC BY 4.0, Open Government Licence v3.0 or NIST reuse terms. ISO/IEC 27001, SOC 2, BSI IT-Grundschutz and Def Stan mappings use original descriptions plus factual names and identifiers, without publisher text, PDFs, logos, official badges or endorsement claims. This describes TenuVault’s implementation basis, not a legal clearance or publisher partnership.

Compare your tenant with a policy pack

Select the tenant in the sidebar, then open UK NCSC Device Security Guidance, Microsoft Security Baselines, DISA STIG or Custom Baselines.

1. Choose your policy pack

“Import one or more Settings Catalog JSON exports. Review the source, version and intended profile before comparison. Loading a pack does not change your tenant.”

On UK NCSC Device Security Guidance, click Load NCSC Windows 2025. See UK NCSC Device Security Guidance.
On Microsoft Security Baselines, DISA STIG or Custom Baselines, use Import policy JSON to select one or more .json files. Each file holds one policy or an array of policies.

The header shows how many policies are loaded. Then:

Enter Source version / profile, for example “approved workstation baseline, revision 3, standard profile”. It is required before you can compare, and is limited to 200 characters. The NCSC pack fills it in for you.
Expand Review N loaded policies and remove alternative profiles. Some packs include alternative profiles for some settings; click Remove next to the ones you do not use. Alternatives left in the pack produce Review findings.
Optional: click Export coverage and source mappings to save a JSON inventory of every policy and setting mapping, its provenance, and the areas outside automated coverage.

Requirements for imported policies

Between 1 and 200 policies, 8 MB in total.
Each policy needs name, platforms, technologies and a non-empty settings array.
Each setting needs a settingInstance with a settingDefinitionId and its @odata.type.
Tenant-specific IDs, assignments, scope tags and export annotations are removed from what TenuVault would create.

Errors such as “Policy 3: expected a Settings Catalog export with name, platforms, technologies and settings.” tell you which policy to fix.

2. Compare with your tenant

Click Run comparison (Compare again for later runs). TenuVault reads all Settings Catalog policies in the tenant, every page of each policy’s settings, and each policy’s assignments. If any read fails or is incomplete, the comparison stops instead of reporting settings as missing.

The result shows how many tenant policies were read and when. Filter the findings with All, Present, Missing, Different and Review:

Result	Meaning
Present	Every occurrence of the setting in your tenant matches the recommended configuration.
Missing	No policy of the same family and platform configures the setting.
Different	At least one occurrence differs from the recommendation, even if another policy matches.
Review	The pack contains alternative values for this setting. Remove the alternative profiles, or resolve the recommendation yourself.

How matching works:

Settings are matched by their setting definition, never by policy name.
Nested values are compared. Extra nested values in your policy produce Different.
Collections are compared in order, so a reordered collection may show Different and need manual review.
An unassigned policy can still be Present.

Expand a finding to see Recommended configuration next to Observed policies and configuration. The observed side lists each matching policy with its value and its assignment evidence: all devices, all users, groups, exclusions and filter references. Targeting is reported as unassigned, configured, review or unavailable. A denied or incomplete assignment read is shown as unavailable, never as unassigned.

Use Search setting or policy above the status filters to narrow the findings. It matches the setting ID, its readable name and the policy name; every word you type must match, in any order. The counts on All, Present, Missing, Different and Review follow the search, and the page shows how many of the findings are shown. Clear search removes it. Findings you selected stay selected when a search or status filter hides them, and the footer says how many selected findings are hidden.

Findings are shown 50 per page. Click Export report to save the assessment as JSON. The report always holds every finding, whatever the search and status filter show.

3. Review unassigned policies

You can create the Missing settings as new policies. This step is not available for the UK NCSC Device Security Guidance pack, which is comparison and reports only.

To create policies:

Tick the Missing findings you want. Only Missing findings can be selected. The footer shows how many settings and new policies your selection makes, for example “4 missing root settings selected · 2 new policies”.
Click Preview recommended policies.
Expand Inspect the exact policy payloads to see what will be sent.
Tick “I reviewed these recommendations and want to create unassigned policies in tenant.”
Click Create N unassigned policies.

What TenuVault creates:

One new policy per source policy you selected settings from, named [Baseline] followed by the source policy name. Its description records the source version and that it was created unassigned.
Only the selected settings, with their nested dependent settings.
No assignments. Existing policies are never changed or deleted.

Before writing, TenuVault reads the tenant again. If your policies changed since the comparison, it stops with “The tenant policy landscape changed. Compare again before creating policies.” A comparison can be used for creation once, within 15 minutes.

The result lists each policy with its new ID or its error, followed by “Unassigned policies created. Assignment and device verification are still required.” Review the new policies and their conflicts in Intune before you assign them. Run the comparison again to confirm the settings now show as Present.

UK NCSC Device Security Guidance

The UK National Cyber Security Centre publishes its recommended device settings as configuration packs. TenuVault loads the nine Windows Settings Catalog policies of the 2025 pack (Defender, Defender Antivirus, attack surface reduction, App Control for Business, BitLocker, Device Control, Windows Security Experience, Microsoft Edge and General, 187 root settings) from a pinned commit and checks every file against a reviewed SHA-256 hash. If any file cannot be downloaded, does not match its hash or cannot be parsed, nothing is loaded.

Compared: the Windows Settings Catalog policies, with your tenant’s Settings Catalog policies.
Not assessed: the Windows endpoint security exports (Account Protection, Application Control) and the Surface DFCI device configuration export, which use legacy policy formats; the AppLocker XML rules; and the Apple, Android and ChromeOS guidance, which is not in Intune policy format.
Review findings: the pack configures some settings in more than one policy with different values, which shows about ten settings as Review. Decide which value applies to your estate.
Comparison and reports only: you can compare, save and export PDF, CSV and JSON reports on every plan. Creating policies from the NCSC pack is not available.

Contains NCSC configuration packs, Crown Copyright, licensed under the Apache License 2.0. TenuVault modifies the content for comparison: it decodes the files from UTF-16 and removes export metadata, IDs, assignments and scope tags. No endorsement by NCSC. Every export of an NCSC assessment carries this notice.

Saved policy-pack workspace and history

Loaded packs, source versions and assessment results are saved per tenant and framework in encrypted storage on this device. Under Saved workspace and history you can:

Export workspace to save the whole workspace as JSON.
Delete workspace to remove the packs and all history for this framework and tenant.
View read-only to open a saved assessment. Historical assessments cannot be used to create policies; run a fresh comparison first.
Export or Delete a single saved assessment. Deleting an assessment also cancels its pending creation.

A workspace keeps up to 50 assessments and 32 MB. When it is full, step 2 shows Saved assessment history is full with the number of saved assessments, and Run comparison stays unavailable until you make room. A comparison that cannot be saved at the end shows the same notice. To make room:

Click Export saved assessments first if you need the older results.
Click Remove older assessments. It keeps the newest 10 assessments and removes the rest after you confirm. The confirmation states how many are removed. Removed assessments cannot be restored.

You can also delete single assessments under Saved workspace and history.

What policy-pack comparisons do not assess

Policy-pack comparison covers Settings Catalog policies only. These areas are outside its scope:

Compliance policies
Update rings
Legacy security baseline templates
Application deployment
Device enforcement and applicability
Organizational controls and manual audit evidence

Conflicts with other policy families are not evaluated. Profile selection and approval, organizational safeguards and device-side validation remain manual.

Troubleshooting comparisons

Message	Cause and fix
A comparison for this framework is already running.	A comparison for this tenant and framework is still in progress. Wait for it to finish, follow its progress on the framework page, or cancel it.
This comparison is too large to save. Narrow the platforms in scope and compare again.	The result exceeds the local history storage limit. Select fewer platforms and compare again.
Scope or ruleset changed. These runs cannot be compared as tenant configuration drift.	The two comparisons used different platforms, levels or a different ruleset version. Pick a saved comparison with the same scope, or review them separately.
Choose valid platforms, maturity level and risk level.	Select at least one platform and a valid target level, then compare again.
Request failed (403) at … Check Intune permissions for this tenant.	Your account or the app registration cannot read Settings Catalog policies. Check your Intune role.
Policy settings changed while they were read. Wait a moment, then try again.	A policy changed while TenuVault read it. Wait until the change in Intune is finished, then run the comparison or assessment again.
This assessment has expired or was already used. Run comparison again.	More than 15 minutes passed, or policies were already created from it. Compare again.
Another change is being applied to this tenant: label. Try again when it finishes.	Another creation, deployment, undo or change set is running for this tenant. Wait for it to finish. See Troubleshooting.
The selection repeats a setting across multiple policies. Select it from one policy only.	Deselect the duplicate setting in one of the policies.
Provide a source version and profile (up to 200 characters).	Fill in Source version / profile.
The policy pack exceeds 8 MB.	Import fewer or smaller files.
Saved assessment history is full	The workspace holds 50 assessments or 32 MB. Export what you need, then click Remove older assessments or delete single assessments. See Saved policy-pack workspace and history.

OpenIntuneBaseline, to deploy, compare and validate OIB policies
Drift detection
CIS Benchmarks
Plans and features

UK NCSC Device Security Guidance content is Crown Copyright, licensed under the Apache License 2.0.