Remediation PlanningDemo

Deploy fixes, generate runbooks for manual steps, or accept risk with documented justifications.

No AI plan pre-populated. In your tenant, the Plan Remediation button on the results page generates an AI-authored classification for every control. This demo lets you classify manually.

Assign Existing Policies

JIT Active

5 controls across 5 policies are correctly configured but not assigned to any device or user group. Assigning them is a one-click fix that lifts your adjusted score immediately.

iOS2

Windows1

Android1

macOS1

21controls

Action Breakdown

Deploy New18

Update Settings0

Runbook Only3 (14%)

Accept Risk0 (0%)

Your Selections

Deploy New Policies

Update Existing Settings

Runbook Only

Accept Risk

What Needs to Happen

Click to filter the related policies below

Assign Existing

Handled on dispatch page

Current Score68%

After Deployment90%

+21.4% projected improvement

5 controls across 5 policies are configured correctly but not assigned

Assign them to device groups on the dispatch page after selecting your remediation actions below.

Export Plan:HTMLMarkdownPDF

Control	Category	Severity	Risk	Detail
ASR — Block credential stealing from LSASS VT-INTUNE-ES-001 Fix CISNISTCISA	endpoint-security	critical	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Windows Firewall — block inbound RDP from public VT-INTUNE-ES-010 Fix CISNISTCISA	endpoint-security	critical	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Windows minimum OS version (22H2) VT-INTUNE-DC-005 Fix CISNIST	device-compliance	high	medium	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
iOS App Protection — Core Microsoft Apps L2 VT-INTUNE-APP-001 Fix CISNISTHIPAASOC2	app-protection	high	medium	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Android App Protection — Core Microsoft Apps L2 VT-INTUNE-APP-002 Fix CISNISTHIPAASOC2	app-protection	high	medium	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
ASR — Block Office child processes VT-INTUNE-ES-002 Fix CISNISTCISA	endpoint-security	high	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Password complexity — alphanumeric + special (Windows) VT-INTUNE-DCF-008 Fix CISNISTHIPAA	device-configuration	high	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Block personal Android enrollment VT-INTUNE-ENR-004 MissingCreate CISNIST	enrollment	high	low	No matching Intune policy found. Create a new policy from the curated Veri-Tune baseline.
Block jailbroken iOS devices VT-INTUNE-DC-003 Fix CISNISTHIPAA	device-compliance	medium	medium	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
iOS APP — block managed data saved to personal cloud VT-INTUNE-APP-013 Fix CISNISTHIPAASOC2	app-protection	medium	medium	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
iOS APP — minimum app version (Outlook) VT-INTUNE-APP-015 Fix CIS	app-protection	medium	medium	Policy is deployed in report-only mode. Flip to enforced when ready.
Android APP — minimum app version (Outlook) VT-INTUNE-APP-016 Fix CIS	app-protection	medium	medium	Policy is deployed in report-only mode. Flip to enforced when ready.
Outlook mobile — require Modern Authentication VT-INTUNE-APC-004 MissingCreate CISNIST	app-configuration	medium	low	No matching Intune policy found. Create a new policy from the curated Veri-Tune baseline.
Teams mobile — restrict screen sharing VT-INTUNE-APC-006 MissingCreate SOC2HIPAA	app-configuration	medium	low	No matching Intune policy found. Create a new policy from the curated Veri-Tune baseline.
Windows Firewall — enabled for all profiles VT-INTUNE-ES-009 Fix CISNISTHIPAASOC2ISO27001	endpoint-security	medium	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Tamper Protection — enabled on Defender VT-INTUNE-ES-011 Fix CISCISA	endpoint-security	medium	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Screen lock timeout — 5 minutes (Windows) VT-INTUNE-DCF-004 Fix CISNISTHIPAASOC2	device-configuration	medium	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
iOS — block AirDrop on supervised VT-INTUNE-DCF-014 MissingCreate HIPAASOC2	device-configuration	medium	low	No matching Intune policy found. Create a new policy from the curated Veri-Tune baseline.
Feature Update — defer 30 days VT-INTUNE-UR-003 Fix CIS	update-rings	medium	low	Policy is deployed in report-only mode. Flip to enforced when ready.
Expedited Quality Update policy (critical CVE) VT-INTUNE-UR-006 Fix CISCISA	update-rings	medium	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.
Disable SMBv1 client VT-INTUNE-DCF-011 Fix CISNISTCISA	device-configuration	low	low	Policy value does not match the required baseline. Current value diverges from expected; update in place or create override.

18 Deploy3 Runbook

Remediation PlanningDemo

Assign Existing Policies

Selection Summary

Projected Impact

Security Severity Breakdown

Disruption Risk Heatmap