CISPolicyCreator v1.1.0

Highlights

• Completes all 415 CIS Microsoft Intune for Windows 11 Benchmark v5.0.0 recommendation classifications: 371 mapped, 8 requiring administrator input, 36 manual/process controls, and 0 unresolved.
• Clarifies that the 8 Windows 11 recommendations requiring input produce 9 answer fields because one recommendation needs two organization-specific values.
• Produces 325 Settings Catalog policy files plus one Windows compliance policy when all required values are supplied.
• Keeps every generated policy unassigned and validates the complete ZIP, offline importer preparation, and repeated-build byte reproducibility.
• Expands the README with plain-English definitions for mapped, requires input, manual, and unresolved.

Full changelog: v1.0.0...v1.1.0

CISPolicyCreator v1.0.0

CISPolicyCreator v1.0.0

CISPolicyCreator is a local, reproducible, fail-closed pipeline that turns a legitimately obtained, supported CIS Benchmark PDF authored for Microsoft Intune into validated, portable Intune policy JSON files. AI is not a runtime dependency.

Supported benchmark PDFs

• CIS Microsoft Intune for Windows 10 Benchmark 5.0.0
• CIS Microsoft Intune for Edge Benchmark 1.0.0
• CIS Microsoft Intune for Office Benchmark 1.1.0
• CIS Apple macOS 26 Tahoe Intune Benchmark 1.0.0
• CIS Apple iOS 26 and iPadOS 26 Intune Benchmark 1.0.0
• CIS Microsoft Intune for Windows 11 Benchmark 5.0.0 (partial catalog: 154 mapped, 261 intentionally unresolved)

The iOS/iPadOS catalog has one intentionally unresolved recommendation: 3.10.1, Locked enrollment. Microsoft requires a complete 40-setting ADE profile, including organization-specific choices that the tool will not guess. With explicit inputs supplied for the other organization-specific recommendations, the iOS/iPadOS output contains 60 JSON files: 58 assignable policy objects and 2 guarded tenant-wide settings.

Safety guarantees

• no guessed Microsoft Graph definition or choice/value IDs
• ambiguous or incomplete mappings fail closed
• administrator choices require explicit acknowledged input
• human/process controls emit no fake policy JSON
• no assignments are created
• different same-name Intune objects are never overwritten
• CIS PDFs, raw benchmark text, tenant evidence, credentials, and generated private artifacts are not included in this release

Validation

• complete local repository validation passed with PowerShell 7.6.4, Python 3.14.0, and 12 Python tests
• all supported split-policy ZIPs passed offline build and import preparation
• the corrected iOS/iPadOS bundle passed a live dry run and actual test-tenant import
• all 58 imported iOS/iPadOS policies were verified through Graph to have zero assignments
• both required GitHub Actions jobs passed on PR #11

Start with the beginner instructions in README.md. Policy ZIP import is optional; policy assignment remains an explicit administrator action outside this tool.