Compliance Policies and Conditional Access

What it is

A compliance policy is a set of rules a device must meet to be considered healthy, such as a minimum OS version or encryption turned on. Intune evaluates each device and reports compliant or noncompliant. Conditional Access in Microsoft Entra ID can then require a compliant device before it grants access to email, files or apps. Compliance policies and Conditional Access are separate pieces that work together.

How it works

Tenant wide compliance policy settings

Under Endpoint security, Device compliance, Compliance policy settings, two settings apply to every device.

Device compliance policies

Each policy is platform specific: Android device administrator, Android Enterprise, AOSP, iOS/iPadOS, Linux, macOS, Windows and Windows Holographic. Typical rules:

• A minimum or maximum OS version.
• Encryption on (BitLocker on Windows).
• A password or PIN with a set strength.
• Jailbroken or rooted devices are noncompliant.
• Microsoft Defender for Endpoint machine risk score at or under a level.
• Windows health attestation: Secure Boot, code integrity, BitLocker.
• Defender settings such as real time protection and antivirus status.

You assign a compliance policy to users or devices. Assigning to a user checks all of their devices. Assigning to device groups gives clearer reports.

Custom compliance extends the built in settings: a discovery script collects values from the device, and a JSON file defines the rules and the messages. It supports Windows, macOS and Linux (Ubuntu and Red Hat).

Some compliance results are remediated by the operating system, such as forcing a PIN on iOS, while others are only quarantined: the device is marked noncompliant and Conditional Access blocks it.

Actions for noncompliance

Every policy includes Mark device noncompliant, which can be immediate or after a grace period in days. A device inside the grace period shows as In grace period. You can add more actions.

Use schedules, such as email on day 0, lock after 3 days and add to retire list after 30.

Conditional Access with compliance

In Microsoft Entra ID, create a Conditional Access policy that targets users and apps, and in Grant choose Require device to be marked as compliant. Entra ID P1 is needed. When a device enrolls in Intune it is registered in Entra ID and reports its compliance status there. Good practice:

• Set Mark devices with no compliance policy assigned as to Not compliant.
• Use report only mode first and check sign in logs.
• Exclude emergency access accounts.
• Combine with MFA, and consider a Require device to be marked as compliant or Require Microsoft Entra hybrid joined device grant if hybrid devices exist.
• A compliance policy conflicts with a configuration policy for the same setting, and the compliance policy value wins.

Compliance evaluation happens when a device checks in, so a change can take hours to be reflected. Windows also supports client driven evaluation (preview), where the device asks for re evaluation when local state changes.

Monitoring compliance

Use Devices, Monitor, Device compliance and Setting compliance, or the compliance dashboard under Devices, Compliance. The Is active setting shows the validity period status. Company Portal also shows each user the reason and how to fix it.

A worked scenario

A company requires encrypted, up to date Windows 11 laptops to open Exchange Online. The admin creates a Windows compliance policy that requires BitLocker, a minimum OS version and a Defender risk score of Low or lower, with mark noncompliant after 1 day and an email to the user. She sets Mark devices with no compliance policy assigned as to Not compliant, and creates a Conditional Access policy for Exchange Online that requires a compliant device. A new laptop without a policy is blocked until a policy applies.