Endpoint Security Hardening in 2026: A Practical Checklist for Windows, macOS, and Mobile

[For IT Pros]

If you manage laptops, desktops, and mobiles in 2026, you’re not fighting malware — you’re fighting identity theft, token theft, and living-off-the-land attacks. Most breaches still start at the endpoint, and “we have EDR” isn’t a hardening strategy.

This is a practical, opinionated endpoint hardening checklist you can apply in a real organisation, not a lab. Windows, macOS, iOS, and Android, with examples for Microsoft 365 / Intune-heavy environments but adaptable to others (Jamf, MDM, etc.). Use it as a baseline to review where you are and what you’ll fix next quarter.

1. Start With a Clear Baseline: Know What “Secure Enough” Looks Like

1.1 Define your minimum security standard per device type

Before you push a single policy, write down what “a compliant device” means for your org. Keep it on one page per platform so engineers and auditors can actually use it.

At minimum, define for each device type:

  • Ownership: Corp-only, BYOD allowed, or COPE (corporate-owned, personally enabled)
  • OS requirement: Supported versions only (e.g. Windows 11 23H2+, macOS 14+)
  • Identity: Entra ID joined / Entra ID registered / on-prem hybrid
  • Local admin policy: Who (if anyone) can be local admin and how that access is granted
  • Mandatory controls: Disk encryption, EDR, firewall, MFA, device compliance policy

Put this in a living document: “Endpoint Security Baseline – 2026”. Every exception should reference this document and explain the deviation.

1.2 Use baselines, but don’t stop there

Microsoft’s security baselines, CIS benchmarks, and vendor templates are good starting points. They are not your final answer.

  • Start from Microsoft Security Baselines for Windows 11 and Edge
  • Overlay CIS Level 1 where it doesn’t break line-of-business apps
  • Document every intentional relaxation (e.g. weaker hardening for VDI or specific dev teams)

Your goal: one baseline per major device class, not 15 slightly different ones nobody understands.

2. Identity, Access, and Local Admin: Kill the Easy Wins for Attackers

2.1 Remove standing local admin wherever you can

Attackers still love local admin. Don’t give it to them.

  • Default: New devices ship with no user in local Administrators.
  • Use Just-in-Time (JIT) elevation for support (Privileged Access Management, EPM, or tools like BeyondTrust, CyberArk EPM, Microsoft EPM).
  • If devs truly need local admin, scope it: separate device group, tighter Conditional Access, and more aggressive logging.

For Entra-joined Windows, use an Intune policy to ensure local admins are limited:

// Intune Device Configuration > Accounts > Local administrators
group: BUILTIN\Administrators
members (allowed):
  - DOMAIN\\Tier1SupportGroup
  - AzureAD\\<breakglass account>

2.2 Enforce MFA and phishing-resistant options on endpoints

By 2026, MFA fatigue and token theft are common. Your endpoints must enforce strong auth, not just your apps.

  • Require MFA for device registration / join and first sign-in on new devices.
  • Favor FIDO2 security keys, Windows Hello for Business, or platform authenticators over SMS / email codes.
  • Use Conditional Access to block device access if the sign-in risk or device risk is high.

Example Entra Conditional Access approach:

  • Policy 1: Block legacy auth (no excuses in 2026).
  • Policy 2: Require MFA for all users, all cloud apps, excluding break-glass.
  • Policy 3: Require compliant device for admin roles and sensitive apps (HR, finance, code repos).

2.3 Lock down privileged endpoints

Admin workstations should not look like normal user laptops.

  • Separate admin accounts from normal user accounts (no email, no browsing from admin ID).
  • Harden admin devices further: no BYOD, stricter app allow-listing, limited internet, higher logging level.
  • Use Privileged Access Workstations (PAWs) or virtual secure admin workstations when possible.

3. OS-Level Hardening: Windows 11, macOS, and Mobile

3.1 Windows 11 hardening essentials

On Windows, assume attackers will try to live off the land. Limit what they can use.

  • Secure Boot + TPM 2.0 enforced on all compatible hardware.
  • BitLocker with XTS-AES 256, recovery keys escrowed to Entra ID or your key management system.
  • Smart App Control (or equivalent) enabled on new devices; use application control (WDAC) for critical segments.
  • Attack surface reduction (ASR) rules enabled in block mode where possible.

Example PowerShell to verify key settings on a device:

Get-BitLockerVolume | Select-Object MountPoint, VolumeStatus, EncryptionMethod

Get-MpPreference | Select-Object AttackSurfaceReductionRules_Actions

# Check Secure Boot
Confirm-SecureBootUEFI

In Intune, deploy an Endpoint Security > Attack surface reduction policy with at least:

  • Block Office child processes
  • Block executable content from email/webmail
  • Block credential stealing from LSASS

3.2 macOS hardening essentials

macOS fleets exploded with hybrid work. Don’t treat them as “trusted” just because they’re Macs.

  • Require FileVault with institutional recovery key escrowed to your MDM (Intune, Jamf, Kandji, etc.).
  • Enforce OS update minimums and block devices below your patch baseline.
  • Use System Extensions and Network Extensions only from trusted vendors; block kernel extensions where possible.
  • Standardise on managed profiles for Wi-Fi, VPN, and certificates rather than user-added configs.

Example: Intune Device Configuration (macOS) profile basics:

  • FileVault: Enabled, personal + institutional key
  • Password policy: 12+ characters, lock after 5 attempts, auto-lock after 5 minutes idle
  • Restrictions: Block unsigned kernel extensions, block config profile removal

3.3 iOS and Android: containerise work, not people

For mobile, your main risk is data leakage and compromised accounts, not users watching Netflix.

  • Use App Protection Policies (Intune) or equivalent to separate corporate from personal data.
  • Require device PIN/biometrics, encryption, and lock after short idle.
  • Block rooted / jailbroken devices by compliance policy.
  • Disable corporate email in native mail apps if you can’t control them; prefer managed Outlook / similar.

Baseline mobile policy example:

  • iOS: latest -1 major OS version, no jailbreak, screen lock >= 6 digits, Face ID / Touch ID allowed.
  • Android Enterprise: work profile enforced, Play Protect on, no sideloaded apps in work profile.

4. Application Control, Browsers, and Office: Where Users Actually Live

4.1 Application allow/deny: be pragmatic

Full application allow-listing is powerful but can be a nightmare if you jump in blind. Start with high-risk segments and high-value targets.

  • Use Defender Application Control (WDAC) for admins, finance, and servers hosting sensitive data.
  • Elsewhere, start with reputation-based protection and block unsigned, low-reputation binaries.
  • Regularly review EDR alerts for suspicious binaries to feed into your block list.

Approach:

  • Phase 1: Audit mode policy for 30 days.
  • Phase 2: Block obviously bad categories (unsigned from temp, downloads, etc.).
  • Phase 3: Tighten for sensitive groups after testing.

4.2 Browser hardening in 2026

Browser is the new OS. Hardening here pays off quickly.

  • Standardise on a managed browser (Edge, Chrome, or equivalent) with config from MDM.
  • Enforce Safe Browsing / SmartScreen and built-in isolation (Application Guard, site isolation).
  • Block risky categories: crypto-mining, known malware, newly registered domains for critical roles.
  • Control extensions: allow only approved list; block ad-hoc installs for high-risk users.

Example (Edge via Intune ADMX template):

  • SmartScreen: Enabled
  • ExtensionsInstallAllowlist: your approved IDs only
  • Sync: Only to corporate accounts, no personal account sign-in

4.3 Office / productivity suite protection

Malicious docs and macros are still a common entry point.

  • Disable VBA macros from the internet across the estate.
  • Limit macros to signed, trusted locations where absolutely required.
  • Use Protected View for all docs from email / web, and restrict editing unless necessary.
  • Enable ASR rules specifically targeting Office child processes and script abuse.

5. Endpoint Detection, Logging, and Response: Assume Breach

5.1 Standardise on one EDR

Running multiple EDRs creates noise and blind spots. Pick one modern EDR/XDR platform and integrate it properly.

  • Deploy to 100% of corporate endpoints, not just “important ones”.
  • Ensure macOS and mobile coverage, not Windows only.
  • Integrate with your SIEM / SOAR and test end-to-end alert → ticket → response flows.

Key configuration checks:

  • Block mode enabled (not just audit)
  • Tamper protection on
  • Real-time protection + cloud-delivered protection enabled
  • Device tags / groups mapped to your asset inventory (prod, test, high-risk roles)

5.2 Log the right things, not everything

You don’t need every possible event, you need the useful ones with context.

  • Forward key security logs to SIEM: sign-ins, privilege changes, app installs, EDR alerts, ASR blocks.
  • Tag devices with owner, department, criticality so analysts can prioritise.
  • Create a simple mapping: alert type → playbook (who does what in the first 30 minutes).

Example high-value events from Windows endpoints:

  • Local admin group membership changes
  • New services / scheduled tasks created
  • RDP enabled or firewall disabled
  • Credential theft detections (LSASS access, suspicious handle access)

5.3 Test your incident response on real endpoints

A hardening plan is only as good as the first real incident.

  • Run tabletop exercises twice a year using realistic endpoint scenarios: lost laptop, token theft, ransomware detonation.
  • Test remote actions: isolation, selective wipe, full wipe, local password reset.
  • Measure MTTD (time to detect) and MTTR (time to respond) per scenario and set improvement targets.

6. Device Compliance, Drift Management, and Exceptions

6.1 Use compliance policies as a gate, not a report

Compliance policies should actually block things, not just turn dashboards green.

  • Define compliance requirements: OS version, encryption, EDR present, jailbreak / root status, password / PIN.
  • Tie compliance into Conditional Access: no compliant device, no sensitive access.
  • Auto-remediate where possible (e.g. push encryption, update, or EDR install) before blocking.

Example in Intune:

  • Compliance: Require BitLocker, Secure Boot on, Defender active, OS >= 23H2.
  • CA: Block access to Exchange, SharePoint, Entra admin portals if device is non-compliant.

6.2 Handle exceptions like technical debt, not permanent truths

You will have exceptions: legacy apps, specialist hardware, stubborn vendors. The problem is when exceptions live forever.

  • Create exception groups in your MDM and IAM; attach an owner and a review date.
  • For each exception, define compensating controls: network isolation, extra logging, limited access.
  • Quarterly, review: can we retire, upgrade, or replace this exception yet?

Example: a lab PC that can’t run latest Windows.

  • Tag as “Legacy-Lab-HighRisk”.
  • Restrict to lab VLAN, no direct internet, no corporate data access.
  • Stricter monitoring, frequent snapshots / backups, documented owner.

7. User Experience and Change Management: Secure Without Becoming the Enemy

7.1 Don’t ship surprises to production

Harsh truth: if you break people’s work, they’ll find ways around your controls. Plan rollouts like product releases.

  • Always pilot new hardening policies with IT + friendly business users first.
  • Announce what’s changing in plain language: “You’ll see this new prompt… here’s why it matters.”
  • Have a quick rollback path if something critical breaks.

7.2 Give users guardrails, not mysteries

Users will always click things. Give them better instincts.

  • Short in-app tips and banners: “If you weren’t expecting this login prompt, cancel and report it.”
  • Simple security page on your intranet: how to report suspicious emails, lost device process, remote wipe explanation.
  • Quick 10–15 minute refreshers twice a year instead of a 2-hour annual training nobody remembers.

What You Can Do This Week

If your endpoint security feels messy, don’t try to fix everything at once. Pick three moves you can realistically ship in the next 30 days and actually measure:

  • Move 1: Define and publish your 2026 endpoint baseline for Windows, macOS, and mobile (even if it’s v0.1).
  • Move 2: Remove standing local admin from one target group (e.g. new joiners or a single department) and introduce JIT elevation.
  • Move 3: Turn on or tighten one high-impact control: BitLocker/FileVault enforcement, ASR rules in block mode for a pilot group, or a stricter compliance + Conditional Access combo.

Once those are stable, iterate. Endpoint hardening is never “done”, but with a clear baseline, controlled rollouts, and real incident drills, you’ll be far ahead of the average 2026 estate.