VBS and HVCI Intune security baseline fails on Business Premium devices

Hi James R,

Has your issue been resolved yet? If it has, please consider accepting the answer as it helps others sharing the same problem benefit too. Thank you :)

Domic V.

Hi James Rodoreda,

The errors 65000 and 0x82b00006 occur because the Intune DeviceGuard Configuration Service Provider fails to recognize the Windows 11 Business subscription identifier as a valid licensing tier. As your testing demonstrated, this is a deployment pipeline flaw in how Intune validates the payload rather than a hardware capability or true OS restriction, which is why Microsoft Support states the current validation behavior is structurally working as designed. Since removing your paid license to force a fallback to the standard Windows 11 Pro state is not a sustainable operational strategy, you must bypass the Intune security baseline profile for these specific settings.

The most reliable workaround is to deploy a PowerShell script through Intune to manipulate the local system registry, which directly forces the hardware sandboxing features to activate. You need to target the system registry path at HKLM\System\CurrentControlSet\Control\DeviceGuard and set both the EnableVirtualizationBasedSecurity value and the RequirePlatformSecurityFeatures value to 1. By applying these settings directly to the registry, you instruct the operating system to load memory integrity and Virtualization-Based Security upon the next reboot without asking the flawed Intune policy engine for permission. This method successfully secures your endpoints while retaining your licensing advantages, serving as the standard engineering resolution until Microsoft structurally updates their baseline evaluation logic.

Hope this answer brought you some useful information :)

Domic V.