Check the configuration source and locale before using Defender baseline assessments

Source facts

Microsoft documents these benchmarks for Group Policy configurations rather than Intune configurations. The assessment is not supported on Windows systems with a non-English system locale. Some configurations require manual checking and are not automatically assessed for compliance. Microsoft Learn.

Applicability

Use this applicability check for Microsoft Defender Vulnerability Management security baseline assessments. Record the benchmark, Windows locale and management method for the population being assessed before reporting coverage.

DSE recommendation

DSE recommends publishing a coverage statement beside each baseline result. Separate supported automatic checks from devices or settings that need another verification method. Have the endpoint owner approve the evidence route for each excluded population, and keep an unassessed configuration visible until that evidence is available.

Verification

Select representative devices from each reported population and verify that their configuration source and locale fit the documented assessment scope. Review the profile for entries requiring manual checks, assign those checks and retain their results. Confirm that the final summary distinguishes assessed, manually reviewed and unresolved items before using it to justify a remediation decision.

Official references

Microsoft Learn: Security baselines assessment. Source reviewed September 17, 2026.