Configuration Policies (Windows)

Intune-enrolled Windows computers receive a standard set of configuration policies.

Purpose of Stanford University-managed configuration policies

The following lists some general purposes they serve:

Consistently enable baseline security settings for Windows
Examples
- Require BitLocker disk encryption and escrow recovery keys to Microsoft Entra ID, so a lost password does not mean lost data
- Enable Windows Hello for Business, so you can sign in with a PIN or biometrics backed by hardware security
Ensure security events can be investigated when something goes wrong
Examples
- Set Windows event log sizes so logs are not prematurely overwritten
- Enable auditing of account logon and logoff activity
Perform configurations that we must otherwise do manually
Examples
- Apply Stanford's standard domain settings automatically at enrollment, with no interaction needed on your part

List of Stanford University-managed configuration policies (as of July 2026)

Currently deployed to Intune-enrolled Windows computers:

Policy	What it does
[SU] Stanford Domain Policy	Applies Stanford's standard domain settings, matching the Group Policy configuration used on premises. Includes Windows event log retention settings and auditing of account logon and logoff activity (success and failure), so security events can be investigated when something goes wrong.
[SU] Enable Windows Hello	Enables Windows Hello for Business sign-in, so you can unlock your computer with a PIN or biometrics backed by a hardware security device (TPM) rather than typing your password.
[SU] Bitlocker Encryption	Requires BitLocker full-disk encryption on the operating system drive and fixed drives, protecting your data if the computer is lost or stolen. Stores BitLocker recovery information in Microsoft Entra ID before encryption is enabled, so your recovery key is never lost, and rotates recovery passwords after use.

Policy

What it does

[SU] Stanford Domain Policy

Applies Stanford's standard domain settings, matching the Group Policy configuration used on premises.

Includes Windows event log retention settings and auditing of account logon and logoff activity (success and failure), so security events can be investigated when something goes wrong.

[SU] Enable Windows Hello

Enables Windows Hello for Business sign-in, so you can unlock your computer with a PIN or biometrics backed by a hardware security device (TPM) rather than typing your password.

[SU] Bitlocker Encryption

Requires BitLocker full-disk encryption on the operating system drive and fixed drives, protecting your data if the computer is lost or stolen.

Stores BitLocker recovery information in Microsoft Entra ID before encryption is enabled, so your recovery key is never lost, and rotates recovery passwords after use.

Descriptions are intentionally high level; specific settings are tuned over time. If you have a question about a specific setting, please submit a Help request.

How to view the management applied to your Windows computer

Navigate to Settings > Accounts > Access work or school, select your Stanford account, then choose Info to see the areas managed by Stanford and the most recent sync status.
Open the Company Portal app to see your device's status.

ℹ️ Note: if you do not find a Stanford work or school account here, your computer may not be enrolled in Intune.

Questions?

If you have questions, suggestions, or feedback, please submit a Help request.