# Check the configuration source and locale before using Defender baseline assessments

> Which assessment boundaries matter before reporting Defender benchmark compliance for Windows devices?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-098-check-the-configuration-source-and-locale-before-using-defender-baseline/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:33:22+00:00
- Modified: 2026-09-17T16:38:46+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

Which assessment boundaries matter before reporting Defender benchmark compliance for Windows devices?

## Potentially affected

Use this applicability check for Microsoft Defender Vulnerability Management security baseline assessments. Record the benchmark, Windows locale and management method for the population being assessed before reporting coverage.

## DSE recommendation

DSE recommends publishing a coverage statement beside each baseline result.

## Article

## Source facts

Microsoft documents these benchmarks for Group Policy configurations rather than Intune configurations. The assessment is not supported on Windows systems with a non-English system locale. Some configurations require manual checking and are not automatically assessed for compliance. [Microsoft Learn](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-security-baselines).

## Applicability

Use this applicability check for Microsoft Defender Vulnerability Management security baseline assessments. Record the benchmark, Windows locale and management method for the population being assessed before reporting coverage.

## DSE recommendation

DSE recommends publishing a coverage statement beside each baseline result. Separate supported automatic checks from devices or settings that need another verification method. Have the endpoint owner approve the evidence route for each excluded population, and keep an unassessed configuration visible until that evidence is available.

## Verification

Select representative devices from each reported population and verify that their configuration source and locale fit the documented assessment scope. Review the profile for entries requiring manual checks, assign those checks and retain their results. Confirm that the final summary distinguishes assessed, manually reviewed and unresolved items before using it to justify a remediation decision.

## Official references

[Microsoft Learn: Security baselines assessment](https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-security-baselines). Source reviewed September 17, 2026.

## Primary reference

- Name: Security baselines assessment - Microsoft Defender Vulnerability Management | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/defender-vulnerability-management/tvm-security-baselines
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Check the configuration source and locale before using Defender baseline assessments,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-098-check-the-configuration-source-and-locale-before-using-defender-baseline/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.