Intune compliance: the often-neglected foundation of "require compliant device"
"Require compliant device" appears in almost every Conditional Access recommendation. But what does "compliant" mean in your tenant? If nobody has defined demanding criteria, a device can be marked compliant with no encryption, no active antivirus and an outdated operating system.
Conditional Access delegates the decision to Intune
Conditional Access does not check the device's state itself: it reads the compliance attribute calculated by Intune. The quality of the control therefore depends entirely on compliance policies, their scope and their settings. A flawless Conditional Access policy can rest on almost empty compliance criteria.
What a compliance policy should check
For Windows, the most relevant criteria are usually:
- Encryption: BitLocker required, ideally through device health attestation.
- Secure Boot and code integrity.
- Minimum OS version, raised regularly to exclude versions that no longer receive updates.
- Microsoft Defender: antivirus active, real-time protection, up-to-date signatures.
- Firewall enabled.
- Where applicable, the risk level reported by Defender for Endpoint, depending on your licence.
Mobile platforms have their own criteria: passcode, jailbreak or root detection, minimum version. Every platform in use needs its own policy, otherwise it escapes control.
Grace periods
Actions for noncompliance let you set a delay before a device is marked noncompliant. This gives users time to fix the issue (install an update, re-enable a service), but an overly long delay amounts to requiring nothing. A few days is usually enough; anything longer needs a documented reason.
The setting that changes everything
In the tenant's compliance policy settings, "Mark devices with no compliance policy assigned as" is set to Compliant by default. In other words, a device enrolled in Intune but not targeted by any policy satisfies the compliant-device requirement. Switch this setting to Not compliant once you have confirmed that all your platforms are covered.
The compliance status validity period also deserves attention: a device that stops reporting during that period becomes noncompliant.
Classic trap. An Intune dashboard showing 100% compliant devices is not good news in itself. It is often a sign of weak criteria, or of devices with no policy counted as compliant by default.
Avoiding false confidence
Compliance is a declarative snapshot evaluated periodically. It does not replace an EDR solution, patch management or monitoring. Also check the consistency of your Conditional Access policies: if one accepts "hybrid joined device" as an alternative, the compliance requirement can be bypassed that way.
What an audit checks
- A compliance policy for every platform in use.
- The criteria actually required (encryption, version, antivirus, firewall).
- Configured grace periods.
- The value of the setting for devices with no assigned policy.
- The link between compliance and Conditional Access policies.