Intune Configuration Profiles push security settings to every enrolled Windows device automatically. Here's the baseline profile set Optimyze deploys for every Business Premium client.
Intune Configuration Profiles are how you push settings to enrolled devices without touching each one individually. A profile created in the Intune portal is assigned to a group of devices, and those settings are applied automatically — immediately for online devices, on next check-in for offline ones. Configuration Profiles are the mechanism that makes "set and forget" security configuration possible at scale.
The baseline Windows profile set Optimyze deploys
Security baseline
Microsoft publishes security baselines for Windows — hundreds of Group Policy settings aligned to Microsoft and CIS best practices. Optimyze applies the Microsoft Security Baseline for Windows 11 as the foundation, then adds client-specific settings on top.
Windows Update for Business
Quality updates (patches) deferred 5 days from release (allowing any bad patches to be identified), then deployed to a ring of pilot devices, then deployed to all devices. Feature updates managed to maintain Windows 11 current versions across the fleet.
Microsoft Defender Antivirus configuration
Cloud-delivered protection enabled, real-time protection enforced, exclusions managed centrally, and potentially unwanted application (PUA) blocking enabled — preventing the adware and bloatware that often accompanies legitimate software installers.
Firewall and network
Windows Defender Firewall enabled and locked — users can't disable it. Firewall rules for specific applications managed centrally rather than via per-device configuration.
Application control
For higher-security clients, application control via Windows Defender Application Control (WDAC) restricts which applications can execute — blocking unknown executables including most malware. Optimyze implements WDAC in audit mode first, as with ASR rules, before enforcement.
