Skip to content

CISPolicyCreator v1.0.0

Choose a tag to compare

View all tags
@JoeryVandenBosch JoeryVandenBosch released this 18 Aug 14:30
v1.0.0
cc4936a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

CISPolicyCreator v1.0.0

CISPolicyCreator is a local, reproducible, fail-closed pipeline that turns a legitimately obtained, supported CIS Benchmark PDF authored for Microsoft Intune into validated, portable Intune policy JSON files. AI is not a runtime dependency.

Supported benchmark PDFs

  • CIS Microsoft Intune for Windows 10 Benchmark 5.0.0
  • CIS Microsoft Intune for Edge Benchmark 1.0.0
  • CIS Microsoft Intune for Office Benchmark 1.1.0
  • CIS Apple macOS 26 Tahoe Intune Benchmark 1.0.0
  • CIS Apple iOS 26 and iPadOS 26 Intune Benchmark 1.0.0
  • CIS Microsoft Intune for Windows 11 Benchmark 5.0.0 (partial catalog: 154 mapped, 261 intentionally unresolved)

The iOS/iPadOS catalog has one intentionally unresolved recommendation: 3.10.1, Locked enrollment. Microsoft requires a complete 40-setting ADE profile, including organization-specific choices that the tool will not guess. With explicit inputs supplied for the other organization-specific recommendations, the iOS/iPadOS output contains 60 JSON files: 58 assignable policy objects and 2 guarded tenant-wide settings.

Safety guarantees

  • no guessed Microsoft Graph definition or choice/value IDs
  • ambiguous or incomplete mappings fail closed
  • administrator choices require explicit acknowledged input
  • human/process controls emit no fake policy JSON
  • no assignments are created
  • different same-name Intune objects are never overwritten
  • CIS PDFs, raw benchmark text, tenant evidence, credentials, and generated private artifacts are not included in this release

Validation

  • complete local repository validation passed with PowerShell 7.6.4, Python 3.14.0, and 12 Python tests
  • all supported split-policy ZIPs passed offline build and import preparation
  • the corrected iOS/iPadOS bundle passed a live dry run and actual test-tenant import
  • all 58 imported iOS/iPadOS policies were verified through Graph to have zero assignments
  • both required GitHub Actions jobs passed on PR #11

Start with the beginner instructions in README.md. Policy ZIP import is optional; policy assignment remains an explicit administrator action outside this tool.

Assets 2
Loading