Create a baseline to configure your device to industry-recommended settings and configurations. Workspace ONE UEM currates Baselines based on industry favorites including CIS Benchmarks.


Baselines require that devices are enrolled in Workspace ONE UEM and have the Workspace ONE Intelligent Hub installed.

You must add the LGPO.exe to all devices that you want to assign a baseline to. You must install the EXE at C:\ProgramData\Airwatch\LGPO\ LGPO.exe.


  1. Navigate to Devices > Profiles & Resources > Baselines and select New
  2. Enter a Baseline Name, Description, and select the smart group the baseline is Managed By. Then select Next.
  3. Select a baseline:
    Setting Description
    Windows 10 Baseline Select this option to use the Windows 10 Baseline. This baseline applies commonly used Windows 10 security configurations for the selected OS version.

    Select the device OS version for the baseline.

    CIS Windows 10 Benchmarks Select this option to use the CIS Benchmarks for Windows 10. This baseline applies the configuration settings recommended by CIS Benchmarks.

    Select the OS version and benchmark level to apply.

    Custom Baseline Select this option to upload and use your own custom baseline. You must create this baseline outside of Workspace ONE UEM.
  4. Select Next.
  5. Review the summary and select Save & Assign.


Workspace ONE UEM assigns the baseline to all devices in the smart group.

What to do next

You must restart the device for the baseline to take affect.