Windows 11 26H2 Security Baseline in Intune: What Admins Must Update

Why this matters for Windows 11 26H2 admins

Windows 11, version 26H2 is now generally available, and Microsoft has confirmed that the associated security baseline — a Microsoft-curated set of recommended security settings — is now available in Microsoft Intune. For SMB administrators managing Windows devices through Intune, this raises a practical question that goes beyond “is it available”: when a new baseline version shows up, does it apply itself to devices already covered by an existing baseline profile, or does someone need to take action?

Based on Microsoft’s own Intune documentation, the answer is clear: new baseline versions do not apply themselves. Administrators have to deliberately update their existing baseline profiles to adopt the new settings, and that update process has specific steps and choices that are worth understanding before you touch a production profile.

What Microsoft confirmed about the 26H2 baseline in Intune

According to an October 2026 update on the Microsoft Intune Customer Success blog, the Windows security baseline for Windows 11, version 26H2 is now available for all customers in Microsoft Intune. Microsoft describes it as the latest available Windows security baseline in Intune, reflecting current Microsoft security recommendations.

The same post outlines what the current 26H2 baseline includes:

• A new recommendation for Configure Windows Ready Print driver ranking.
• An updated Turn off encryption support recommendation, changing the supported Transport Layer Security (TLS) versions from TLS 1.1 and 1.2 to TLS 1.2 and 1.3.
• A note that Configure NetBIOS settings is still pending availability in the settings catalog and will be added to the baseline in a future update.

This announcement is specifically about baseline availability inside Intune. It was published alongside a broader update confirming that the Intune settings catalog — the interface used to build custom device configuration profiles — now supports new and updated Windows policy settings introduced with 26H2, independent of the baseline itself.

A related but separate baseline publication

Microsoft’s Security Baselines team also published a separate “Windows 11, version 26H2 security baseline” post describing a downloadable baseline package available through the Microsoft Security Compliance Toolkit (SCT). This is a different distribution channel than the Intune baseline profile — it’s a package you can download and apply outside of Intune, such as through Group Policy.

That SCT-focused post describes an updated “v2” package reflecting the general availability of Administrator protection, a Windows security capability that provides just-in-time administrative privileges rather than standing admin rights. Per Microsoft, the security baselines for Windows 11 versions 24H2, 25H2, and 26H2 all include settings that enable Administrator protection, and organizations can turn it on through either Microsoft Intune or Group Policy. The same source notes two specific policies tied to this change:

• User Account Control: Configure type of Admin Approval Mode
• User Account Control: Behavior of the elevation prompt for administrators running with Administrator protection

Microsoft explicitly recommends that organizations review and test their existing Administrator protection configuration as appropriate for their environment given this update.

It’s worth being precise here: the supplied sources confirm the Intune baseline and the SCT package cover overlapping security recommendations (including the print driver ranking and TLS changes), but they are documented as separate deployment mechanisms. Don’t assume version numbering or packaging between the two is identical just because the underlying recommendations align.

Why your existing Intune baseline profiles won’t update themselves

This is the part many admins miss. Microsoft Intune’s documentation on configuring security baseline policies is explicit about how version updates work, and the behavior applies to Intune security baselines in general — not just the 26H2 release:

“Existing profiles for that baseline type don’t automatically upgrade to the new version.”

When a new baseline version is published in Intune:

• Existing profiles stay on whatever version they were created with. Nothing changes on enrolled devices just because a newer baseline version appears in the admin center.
• The settings inside those existing profiles become read-only. You can still edit a profile’s name, description, and group assignments, but you can’t modify individual setting configurations within an outdated version.
• To adopt new settings or changed defaults from the newer version, you must deliberately run the baseline’s Update Version process.

Microsoft’s documentation also explains why this matters: a newer baseline version can add settings that didn’t exist before, retire settings that are no longer supported, and — importantly — change the default configuration for existing settings to align with current security recommendations. The TLS version change in the 26H2 baseline (from TLS 1.1/1.2 to TLS 1.2/1.3) is a concrete example of exactly this kind of default change described generically in the Intune documentation.

What happens when you do update a profile

When you choose to update an existing baseline profile (one created in May 2023 or later) to a newer version, Intune does not simply modify your existing profile in place. Instead, documented behavior is:

1. Intune creates a new, side-by-side copy of the profile based on the latest baseline version.
2. You choose one of two update methods:
   • Keep existing setting customizations – your prior custom configurations are carried into the new profile.
   • Discard existing setting customizations – the new profile uses the baseline’s default values for every setting.
3. You must assign a name to the new profile, but scope tags and assignments are not carried over automatically — you have to reconfigure them. You can, however, review the new profile’s configuration settings before saving it.
4. The original profile is left unchanged and keeps its own settings, scope tags, and assignments until you remove or modify it.

Because the new profile isn’t assigned to any devices at the moment it’s created, it won’t deploy anywhere until you add group assignments — which gives you a natural opportunity to test it on a limited group before wider rollout.

Practical recommendations for SMB admins

The following steps reflect practical governance guidance rather than a documented Microsoft requirement, but they align with how Intune’s baseline update process is designed to work:

• Don’t assume adoption is automatic. If you want the 26H2 baseline recommendations — including the TLS default change — applied to managed devices, you need to run the baseline update process on your existing profile rather than waiting for it to take effect on its own.
• Review the new profile’s settings before you save it. When you update a baseline profile created in May 2023 or later, Intune lets you review the configuration settings in the newly created profile on the Configuration settings tab before you finish creating it, so you can confirm which values are carried over and which have reverted to defaults.
• Test on a representative group first. Since the update process creates a separate profile without assignments, use that gap to validate the new settings on a pilot group before assigning it broadly.
• Re-check Administrator protection settings. If your organization already uses Administrator protection, Microsoft’s guidance suggests reviewing and testing your existing configuration in light of the 26H2 baseline changes rather than assuming it will behave identically.
• Track the pending NetBIOS setting. Since Microsoft has stated the Configure NetBIOS settings recommendation is not yet in the settings catalog, expect a follow-up baseline update once that setting becomes available.

Licensing and permissions to keep in mind

Deploying security baselines through Intune requires an active Microsoft Intune Plan 1 subscription, per Microsoft’s documentation. Intune provides the interface to configure and deploy baselines, but it doesn’t independently create the underlying security recommendations — those come from the relevant product security teams.

To manage security baselines, an administrator’s account needs an Intune role-based access control (RBAC) role with sufficient permissions, specifically Organization (Read) and Security baselines (Assign, Create, Delete, Read, Update). Microsoft identifies the built-in Policy and Profile Manager role as the least-privileged built-in role that supports managing security baselines, though these permissions can also be added to a custom role.

Conclusion

Microsoft has confirmed that the Windows 11, version 26H2 security baseline is now available to all customers in Intune, bringing updated recommendations such as print driver ranking and tighter TLS requirements. But availability in Intune is not the same as adoption on your devices. Microsoft’s own documentation is clear that existing baseline profiles never update automatically — administrators must explicitly run the version update process, decide whether to keep or discard customizations, and reassign scope tags and group assignments on the new profile.

For SMB administrators, the practical takeaway is to treat the 26H2 baseline release as a planned change management task rather than a passive update: review what’s new, test the updated profile on a limited group, and only then roll it out — rather than assuming your current baseline configuration already reflects Microsoft’s latest recommendations.

This article is a draft prepared for review and is based solely on the Microsoft sources cited above. It requires human review before publication.