Microsoft Endpoint Manager – Intune Compliance Policies

Hi everyone! Many organizations want to be sure corporate devices to meet requirements to protect access to corporate network or company data only for compliant devices. By using the Intune Compliance Policies, you can create and assign access on corporate devices or personal devices, then you can alert your users, or you can block access to corporate resources with Azure AD Conditional Access.

There are two parts of Intune compliance policies:

  • Policies which define criteria and rules we can configure and deploy on devices;
  • Settings which define actions for noncompliant devices and determine how compliance policies will interact with user devices.

You can configure compliance policies from Devices – Compliance policies or from Endpoint security – Device compliance. First, let’s configure compliance settings:

Here you can configure tenant-wide options:

  • Mark devices with no compliance policy assigned as will mark all of the devices as noncompliant until compliance policies assigned;
  • Enhanced jailbreak detection applies to iOS devices only;
  • Compliance status validity period (days) specifies a period in which device must sent a compliance status report. If device can’t send a report to Intune for some reasons device will be marked as noncompliant. By default, period is 30 days. In my lab environment I reconfigured it to 1.

In Notifications you can create a message template will be sent to users if device is threated as noncompliant. Click Create notification, provide a name for a template:

Then click Next and provide a notification message:

Then click Next and Create.

Go to Policies to create a first compliance policy. Click Create, then choose a planform – Windows 10 and later and click Create. Provide a name of the policy and click Next. On Compliance settings page you can configure Custom Compliance:

First, you need to upload PowerShell script in Scripts and prepare JSON file. JSON file identifies custom compliance settings you want to check and PowerShell script will discover settings you defined in JSON file.

Device Health:

Windows Health Attestation Service with a series of checks can validate boot state.

Device Properties:

In this section I configure a minimum OS version, device with OS build below will be marked as noncompliant.

Configuration Manager Compliance:

I don’t use integration with Microsoft Endpoint Configuration Manager, we will check compliance status from Intune only.

System Security consists of a couple of sub-sections, first is Password:

I don’t require password in my example. Next is Encryption:

I don’t configure this setting as well.

Device Security:

I want to check if firewall, antispyware and antivirus (built-in antivirus or any 3rd party antivirus that can be registered with Windows Security Center) are enabled.


In this section we configure Microsoft Defender antimalware and real-time protection checking as part of our compliance policy.

Windows Defender for Endpoint:

I keep default settings.

When you configured all the settings you want to check click Next. On the Actions for noncompliance tab, you configure sequence of actions for noncompliant devices. At least one action must be configured:

In my example, I want to inform user twice his device is noncompliant (remember, we have a message template?). If user doesn’t run remediation steps we mark this device as noncompliant and after 30 days devices will be marked as retired. Then this device can be manually removed from Retire noncompliant devices section.

Click Next. On Assignments tab I add two dynamic Azure AD groups with personal and unknown devices:

And then click Create.

Right after the enrollment Windows 10 devices checks policies and settings every 3 minutes for 15 minutes, then every 15 minutes for 2 hours, and then around every 8 hours. Already enrolled device checks Intune settings every 8 hours. Also, end user can trigger policy check from Company Portal or from Access work or school:

In this example we don’t block access to corporate date (it will be covered in next blog), we just check a compliance status. To do that go to Devices – Compliance status:

On this dashboard you can find high-level overview of compliance status and policies.

To get more detailed information go to Devices – Monitor – Compliance:

Setting compliance report shows an information about all of the compliance settings:

Click on a setting to see additional details:

Click on device name, then on Device compliance:

By default, Built-In Device Compliance Policy is assigned on all of the devices. This policy contains three settings:

Click on setting you created to see a compliance status:

You can also check compliance status from Devices – Compliance policies – <click on policy name>:

Happy deployment!

You can also learn more about Microsoft EndPoint Patch Management Strategies by clicking here:



Contact Us

On Key

More Posts

Mastering Azure AD Connect - A Comprehensive Guide by WME
Active Directory

Mastering Azure AD Connect – A Comprehensive Guide

Modern businesses are fast moving toward cloud-based infrastructure. In fact, cloud-based business is not just a trend anymore but a strategic necessity. Microsoft’s Azure Active Directory (Azure AD) has become a frontrunner in this domain. It

Read More »
Security Best Practices in SharePoint
Office 365

Security Best Practices in SharePoint

Microsoft SharePoint is an online collaboration platform that integrates with Microsoft Office. You can use it to store, organize, share, and access information online. SharePoint enables collaboration and content management and ultimately allows your teams to

Read More »
The Ultimate Guide to Microsoft Intune - Article by WME
Active Directory

The Ultimate Guide to Microsoft Intune

The corporate world is evolving fast. And with that, mobile devices are spreading everywhere. As we venture into the year 2024, they have already claimed a substantial 55% share of the total corporate device ecosystem. You

Read More »
Protecting Microsoft 365 from on-Premises Attacks
Cloud Security

How to Protect Microsoft 365 from On-Premises Attacks?

Microsoft 365 is diverse enough to enrich the capabilities of many types of private businesses. It complements users, applications, networks, devices, and whatnot. However, Microsoft 365 cybersecurity is often compromised and there are countless ways that

Read More »
Be assured of everything

Get WME Services

Stay ahead of the competition with our Professional IT offerings.