ConfigForge is a desktop app for creating, reviewing, and sharing OSConfig security baselines. Start from a Microsoft template or your own settings, compare changes, and export your work before deciding whether to test it on a device.
Experimental and community-maintained. ConfigForge is not an officially supported Microsoft product and is not intended for production use. It is provided as-is for learning and evaluation, at your own risk.
Start here: Install the app → Create your first baseline. You do not need a CLI, administrator access, or an Azure subscription to complete this authoring walkthrough.
Keep desired settings in one editable baseline rather than reconciling separate spreadsheets and handwritten change notes. ConfigForge helps you compare drafts, record why values changed, and share a review report. It does not certify a baseline or prove that a device is compliant.
- Baseline: your set of desired security settings.
- Manifest: the YAML or JSON document describing a baseline.
- Register: save a baseline in My Baselines. Registration does not deploy settings or create an Azure resource.
See the glossary when you need more terminology.
Choose the next task you need; the advanced sections are optional.
| Task | Start here | What to expect |
|---|---|---|
| Create or edit a baseline | Baseline editor | Code/Visual editing, validation, and YAML/JSON/MOF/CSV export |
| Compare drafts | Diff | Pairwise comparison or a matrix of up to ten baselines |
| Review benchmark coverage | Benchmark Mapping | Matches against your own licensed data; no CIS data is bundled |
| Explain changes | Rationale and history | Saved change reasons and snapshots |
| Share review material | Audit Pack | PDF or Markdown from available saved data; not a new device audit |
| Check a local lab device | Authoring vs deploying | Optional CLI-based Audit, Deploy, and Revert in the Full edition |
| Evaluate through Azure Policy | Machine Configuration | Separate packaging, testing, hosting, and policy-assignment workflow |
The sidebar uses Dashboard, My Baselines, Microsoft Baselines, Export Readiness, Diff, Benchmark Mapping, and Settings. Export Readiness concerns baseline validation; it is not a device-compliance result.
Keep the results distinct: benchmark coverage identifies matching rules, not necessarily matching values. Device Audit checks a machine. Audit Pack exports a report and only includes device results when saved results exist. Review their timestamps, scope, and any unread or unavailable settings.
| Your computer | Edition | Start with |
|---|---|---|
| Windows (x64) | Full | Authoring without extra tools; local device operations need oscfg and elevation |
| Linux (x64) | Full | Authoring; live device operations additionally need a compatible CLI/host and permissions |
| macOS on Apple Silicon (M1 or later) | Author | Authoring, Diff, Benchmark Mapping, history, rationale, and Audit Pack export; no device operations |
The current Windows/Linux release is v0.3.104. The current macOS Author release is mac-v0.3.104-author.1. Both are prereleases and unsigned; macOS is not notarized. Intel Macs and universal binaries are not supported. Read the download and installation guidance first.
- Baseline authors: begin with Your first baseline.
- Reviewers: compare drafts and inspect an Audit Pack, keeping benchmark coverage separate from device evidence.
- Lab operators: read Authoring vs deploying before using device operations.
- Contributors: the system overview, module map, and contribution guide cover implementation details.
The app authors baselines. For optional local operations, the Full edition
calls the native oscfg CLI, which is installed separately. The targeted CLI
is oscfg 1.3.9-preview11; CLI compatibility is separate from package tooling.
For Azure Machine Configuration, export a MOF and move to a packaging machine with PowerShell 7, GuestConfiguration, and the Microsoft.OSConfig PowerShell module 1.4.10 or later. Version 1.4.10 refers to the module, not the PowerShell runtime. Follow the packaging prerequisites; these tools are not required to author in ConfigForge.
Source and documentation live at
Azure/ConfigForge. The active branches
are main for Windows/Linux Full and mac-author-build for macOS Author.
The documentation site's edit link opens the corresponding Markdown source.
Community-maintained by @ABMFST. Use GitHub Issues for reproducible bugs and feature discussions. Read the support boundaries and report vulnerabilities privately through SECURITY.md.