Intune Documentation desktop 0.4.0

New

Evidence register and Purview evidence pack

Compliance Evidence gains an Exports section on every framework screen.

• Evidence register (Excel and CSV). The assessment as tables: one row per control and one row per technical check, with policy, setting, expected value, actual value and assignment. The Excel workbook adds an About sheet with the status definitions and a Policy status sheet with Intune's device counts per policy. The CSV file holds the checks.
• Purview evidence pack (ZIP). One file to attach in Microsoft Purview Compliance Manager, with the framework evidence PDF, the JSON evidence record, an index of every assessed control with the matching Purview template name and where to find it in the PDF, and the upload steps. Control IDs follow the regulation, so check them against your tenant's template before you attach the pack. The pack is evidence for your assessment, not a verdict on any control.

Draft fix pack

For safeguards with no evidence at all, the app can save draft Windows Settings Catalog policies as JSON.

• Every draft is unassigned and has no effect until you review it, import it in the Intune admin center and assign it yourself. The app never writes to your tenant.
• Drafts are only generated when a complete collection established that the setting is really missing and every value is verified. Settings that are configured differently, conflicting or already set in an unassigned policy get a reason instead of a draft, so you change or assign the existing policy.
• Saving asks you to read four warnings first. The pack repeats them in its README and in every policy description, including: assign each policy to a pilot group first.

History: encrypted snapshots on your computer

Turn on Keep history on this computer and the app saves a snapshot after each collection.

• Snapshots are stored encrypted on your computer and never leave it. The encryption protects them if the disk or your user folder is copied and from other users of the computer. It does not protect against software that runs under your own account. If secure storage is not available, history stays off and the app says why. Snapshots are never stored without encryption.
• A snapshot keeps the policy settings, assignments and the assessment made at collection time. Script contents, app payloads and details the comparison does not need are not kept. Up to 30 snapshots per tenant are kept for up to 365 days and up to 500 MB in total, oldest removed first.
• The new History screen compares two snapshots: policies added, removed, renamed and changed, setting values before and after, assignment changes, and control status changes with the evidence that caused them. Parts of a partial collection are marked as not compared, never shown as removed.
• Clear local data also removes the snapshot history, its index and its key.

Scheduled collection

With history on, the app can collect automatically every 6, 12 or 24 hours. It runs only while the app is open and you are signed in, checks the license before every run, saves a snapshot like a manual collection, and runs once after waking if a run was due while the computer slept. It never interrupts work already running, and the History screen shows the next run and the result or reason of the last one.

Compare with a reference or another tenant

The new Compare screen checks this tenant's settings against a standard, setting by setting.

• Export a reference file from any tenant and load it later or on another computer. The file holds configured settings only, without assignments and without secret values. Its checksum detects damage to the file, not who made it.
• Results show what is different, missing, extra, not comparable and matching, with the values and policies on both sides.
• On the MSP plan, you can compare directly with the latest snapshot of another tenant that has history on this computer.

Portfolio (MSP plan)

The new Portfolio screen lists every tenant with history on this computer side by side: snapshot count, how old the latest snapshot is, the ruleset that assessed it, and evidence coverage for the framework you choose. Give each tenant a name, and delete a tenant's history when you stop documenting it. The figures come from the encrypted index, so no snapshot is opened to show them.

DORA framework

Compliance Evidence now includes DORA, Regulation (EU) 2022/2554 with its regulatory technical standards, as a desktop only framework. The mapped points provide supporting evidence only. Governance, incident reporting, resilience testing and third party risk need their own assessment, and the report says so per control.

More evidence sources, no new permissions

• The tenant authentication methods policy and security defaults in Entra are now read with the Policy.Read.All permission the app already requests for Conditional Access. They provide supporting evidence for controls about authentication. The app never suggests turning on security defaults while Conditional Access policies exist, because the two cannot be combined. No new permissions are needed.
• A configured screen lock after inactivity, on Windows, macOS, iOS and Android, now counts as supporting evidence where a framework asks for it.

Improved

• Documentation export in the new report design. The PDF and Word documentation now follow the look of the compliance reports: a cover with the tenant, collection date and classification, an At a glance page with assigned, not assigned and unknown counts, a linked table of contents, clearer section headings and tables, and headers and footers with page numbers. Your branding colours, fonts, logos, header and footer text, watermark and confidentiality notice still apply. The coloured coverage grade is gone; the counts speak for themselves.
• Device status counts where you browse. Policy lists show Intune's device counts per policy (succeeded, error, conflict, not applicable, pending), and the evidence report gains the same counts as an annex. They describe rollout only and never change a control status. A policy with no reported status says so instead of showing zero.
• Changes since the previous collection. With history on, the management summary and the exported management report (English and German) show what changed since the previous snapshot: policy, setting and assignment change counts, and how many measures gained or lost evidence. Measures that could not be fully assessed in one of the two collections, for example because a policy could not be read, are listed apart and never counted as gained or lost.
• Checks that depend on an Entra tenant policy that could not be read now show as unable to check, with the reason, instead of reading as missing evidence.
• Update rings without a quality update deadline and Defender scans set to user defined now read as not configured, with a plain reason, instead of unable to check. Where Windows or Defender use a documented default, such as a 2 day grace period or a 2:00 AM scan, the check uses it and says so.
• Values Microsoft Graph did not return, or returned in a form the app does not know, are shown as unable to check or not compared. They no longer read as a gap, as evidence or as a change in History.

Removed

• BSI IT-Grundschutz is no longer included in Compliance Evidence.

Fixed

• Word documentation exports now include the header and footer you set in branding. They were left out before.
• A long confidentiality notice or footer text is no longer cut off in the PDF.
• A policy that Intune reports no device status for is no longer indistinguishable from one with zero devices. It is shown as no status reported in the policy lists, the evidence register and the report annex.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.3.3

New

HIPAA Security Rule

Compliance Evidence now includes the HIPAA Security Rule (45 CFR Part 164, Subpart C), for organisations that handle electronic protected health information in the United States.

• Nine safeguards are mapped to Intune evidence, including workstation security, encryption and decryption, audit controls, integrity and person or entity authentication.
• Each safeguard shows whether the rule marks it Required, Addressable or Standard.
• The report covers 9 of the 54 standards and implementation specifications. Administrative and physical safeguards, your risk analysis and your decisions on addressable specifications still need separate review.
• The evidence report, the JSON evidence record and the management report all support the new framework.
• The management report lists the HIPAA requirements it does not map. It counts the 40 organisational and physical safeguards apart from the 5 that relate to Intune or Entra settings the report does not check yet (unique user identification, automatic logoff and transmission security), so you know which ones to review in the admin center.

The report states the technical evidence found in your tenant. It does not certify HIPAA compliance.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.3.2

Improved

Search settings

• Refreshing your data keeps your search. When a new collection finishes while Search settings is open, the results update in place. Your query and filters are only cleared when you sign out or switch tenant.
• Clear recovery when a search fails. An error now offers Try again, or Collect when there is no collection yet.
• Filters stay visible. Selected family and platform filters are always shown, also while a search runs. When filters hide every match, the page says how many settings match without them and offers Clear filters.
• Long values are readable. Long values such as certificates or XML can be expanded with Show full value, and every value can be copied.
• Tidier results. Long family lists collapse behind More, the search box stays visible while you scroll, and single letters are no longer highlighted.

Fixed

• Screen readers now announce when a search is running and read the new match count instead of the previous one.
• Result cards no longer appear as separate page regions to assistive technology.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.3.1

New

Search settings

A new Search settings page in the sidebar finds any setting across all collected policies, by name, value or technical id. Type "BitLocker", "require device encryption" or a setting id such as device_vendor_msft_bitlocker_requiredeviceencryption, and the results show every policy that sets it, with the configured value, the platform and how the policy is assigned.

• Results are grouped by policy and can be filtered by configuration family and platform.
• Select a policy to open it in its section.
• Search runs on your last collection on this machine, so it also works offline.

Improved

An overview that counts what you configured

The overview headline now shows policies and profiles only. Apps, roles and scope tags, and items Microsoft creates in every tenant are counted on their own cards:

• Apps shows how many apps are assigned out of all apps in the tenant.
• Assignment and RBAC covers roles, role assignments, scope tags, filters and reusable settings.
• Microsoft defaults covers built-in roles, the Default scope tag, the default enrollment configurations, tenant settings, Microsoft published remediations and connectors that are not set up.

Nothing is left out of your documentation: every item is still collected, browsable and exported as before.

Clearer configuration families

• Endpoint security policies and security baselines now have their own families instead of appearing inside Settings Catalog.
• Policies created from the older endpoint security templates are labelled "Endpoint security (legacy templates)" instead of "Security Baselines".
• The Apple enrollment program token is listed under Connectors.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.3.0

New

Redesigned compliance evidence reports

Every framework report has a new design, built to hand straight to an auditor, an insurer or a customer questionnaire.

• A new cover shows the share of controls with technical evidence at a glance, with the document control details underneath.
• An executive summary with the share of controls with technical evidence, the number of safeguards in place, counts per status, coverage per control family and the key findings.
• A results overview lists every control with its status, how many of its capabilities have evidence, the evidence references and the page of its detail section.
• Clearer control details. Each capability has its own card with a table of expected and actual values, the policies behind it and whether each policy is assigned. Settings and values are shown with their names from Intune, such as "Require Device Encryption: Enabled", with the technical name underneath. Gaps and conflicting settings are highlighted, and the parts of a control that need an organisational review are listed separately.
• A cleaner evidence register with a short guide on how to read the report.

This applies to ISO/IEC 27001, NIS2, SOC 2, NIST SP 800-53, NIST SP 800-171, NIST CSF 2.0, Cyber Essentials, ASD Essential Eight, BSI IT-Grundschutz (in German) and Def Stan 05-138.

Sample reports

Sample evidence reports for every framework, based on a fictional tenant, are now available on intunedocumentation.com, so colleagues and auditors can see what a report contains before you share your own.

Improved

• Status is always shown with a shape and a label as well as a colour, so the reports stay readable when printed in black and white.
• Every control, status, evidence reference and count from 0.2.x is still in the report, so reports from 0.2.x and 0.3.0 can be compared directly.
• The German BSI report no longer contains English terms such as "Not found".

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.2.2

New

A security summary for management, with explanations for IT

The management report is now a security summary in two parts.

• Page 1 is for management. It leads with one number, safeguards in place: how many of the technical safeguards behind the framework are set up and switched on in Intune. A bar per measure shows where protection is missing, followed by the five recommended next steps. Plain language, no control ids.
• The following pages are for the IT reviewer. They explain how each number is calculated and what is not counted, and list every safeguard per measure with its state and the policies behind it, including whether each policy is assigned. This lets IT answer management's questions from the same document.
• NIS2 measures carry German titles in the German report.

Safeguards in place

Until now a measure counted as covered as soon as one of its safeguards was in place, so a measure with 2 of 33 safeguards looked the same as one with 2 of 3. The app and the report now show safeguards in place, overall and per measure, for example "2 of 33". Measures with at least one safeguard in place remain visible as a second figure.

Improved

• The management panel in the app uses the same numbers and wording as the report, and each control shows its safeguards in place.
• Baselines now record safeguards in place, so the next report shows the change in percentage points and per measure. Baselines saved with 0.2.1 or earlier still load; for those, the safeguard change starts with your next saved baseline. Baselines saved with 0.2.2 need 0.2.2 or newer, so update every installation that loads them.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.2.1

Fixed

• Technical check results no longer count on/off settings that are not configured. Compliance policies, device restriction profiles and endpoint protection profiles report every on/off setting, and one left at "Not configured" reads as off. These were counted as different values: a compliance policy that only requires the firewall, for example, added "different value" results for BitLocker, encryption and antivirus. They are now ignored. Administrative template and custom (OMA-URI) settings are unchanged, because "Disabled" there is an explicit choice.
• No more false "switched off" findings. An untouched Defender section in a device restriction profile was reported as switching off behavior monitoring, network inspection or virtualization-based security. It now counts as not configured. Evidence coverage is unchanged by this fix, because these defaults never counted as evidence.
• Next actions for unassigned policies. A setting with a non-enforcing value in a policy that is not assigned is now suggested as "Configure", not "Review policies that switch off", since it does not reach any device.

Improved

• The technical check tiles show how many results come from assigned policies. Check results compare every policy, assigned or not, while evidence coverage only counts assigned policies.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.2.0

New

Management report

A one-page PDF for management and other readers outside IT, in English or German. Open Compliance Evidence, choose a framework and select Export management report.

• Evidence coverage: the share of controls that Intune can evidence which have supporting configuration evidence. It is a coverage figure, not a compliance score or audit result.
• Key metrics: controls with evidence, controls without evidence, unassigned security configurations, and change since the last baseline. Each metric links to a detail page in the same PDF.
• Next actions: the five most useful steps, ranked so that controls without any evidence come first. Each links to the matching page in the Intune or Entra admin center.
• Measures that Intune cannot evidence, such as policies, supplier security or business continuity, are counted in one line so they can be assessed separately.

Progress month over month

Select Save baseline to store this month's result as a small file. Next month, select Load baseline to show the change: coverage points, newly evidenced controls and regressions. The file holds control identifiers, statuses and counts only, never policy names or settings. A baseline from another tenant, another framework or another scope is rejected.

NIS2

NIS2 (Directive (EU) 2022/2555, Article 21(2)) is now available as the 11th framework. Six of the ten measures are mapped to Intune evidence: incident handling, vulnerability handling, cyber hygiene, cryptography, access control and multi-factor authentication. Every measure shows the matching Danish (NIS2-loven § 6, stk. 1) and German (§ 30 Abs. 2 BSIG) reference.

CIS Controls through your own crosswalk

Import your organization's mapping from ISO/IEC 27001 and NIS2 to CIS Controls safeguards with Import crosswalk, using the CSV template from Download template (comma or semicolon separated). Your CIS safeguard ids then appear on the matching ISO 27001 and NIS2 controls and in the management report. The app ships no CIS content and keeps your file in memory for the current session only.

Improved

• The Overview metric cards are clickable: configurations and sections open the family breakdown, warnings open the affected family filtered to items that could not be loaded, and permission gaps jump to the missing permissions.
• Compliance controls show their Danish and German law references as labels.

Installed apps show this update under Settings, Updates: select Download update, then Restart to update. With Install updates automatically turned on, it installs when you restart the app.

Intune Documentation desktop 0.1.4

Desktop app 0.1.4. Existing installations update automatically.

Intune Documentation desktop 0.1.3

Desktop app 0.1.3. Existing installations update automatically.