Compliance Policies¶

Compliance policies define the rules a device must meet to be considered compliant. Non-compliant devices can be blocked from accessing Microsoft 365 resources via Conditional Access.

Intune admin center → Devices → Compliance

Windows Compliance Policy¶

Create a policy for Windows 10 and later:

Intune admin center → Devices → Compliance → Create policy → Windows 10 and later

Device Health¶

Device Properties¶

System Security¶

Microsoft Defender for Endpoint (if licenced)¶

Actions for non-compliance¶

iOS / iPadOS Compliance Policy¶

Device Health¶

Device Properties¶

System Security¶

Android Enterprise Compliance Policy¶

Device Health¶

Device Properties¶

System Security¶

macOS Compliance Policy¶

Compliance Grace Period¶

Configure a grace period to give users time to remediate before being blocked:

Intune admin center → Devices → Compliance → Compliance settings

Monitoring Compliance¶

# Install Microsoft Graph PowerShell if needed
Install-Module Microsoft.Graph -Scope CurrentUser

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

# Get all non-compliant devices
Get-MgDeviceManagementManagedDevice -Filter "complianceState eq 'noncompliant'" -All |
    Select-Object DeviceName, UserPrincipalName, OperatingSystem, ComplianceState, LastSyncDateTime |
    Sort-Object LastSyncDateTime -Descending

# Get compliance summary by platform
Get-MgDeviceManagementManagedDevice -All |
    Group-Object OperatingSystem |
    ForEach-Object {
        $os = $_.Name
        $total = $_.Count
        $compliant = ($_.Group | Where-Object { $_.ComplianceState -eq "compliant" }).Count
        [PSCustomObject]@{ OS = $os; Total = $total; Compliant = $compliant; NonCompliant = ($total - $compliant) }
    }