How to Configure Compliance Policies in Microsoft Intune

Device compliance policies are the foundation of a Zero Trust security model in Microsoft Intune. By defining and enforcing security requirements across your device fleet, you ensure that only trusted devices can access your organization's resources. This guide covers creating, configuring, and deploying compliance policies for all major platforms.

Overview

Compliance policies work alongside Conditional Access to protect your organization:

1. Compliance policies define what makes a device "compliant" (encryption, OS version, password complexity, etc.)
2. Intune evaluates enrolled devices against these policies
3. Conditional Access can block non-compliant devices from accessing corporate resources
4. Users receive notifications to remediate compliance issues

Prerequisites

Before configuring compliance policies, ensure you have:

Licensing Requirements:

• Microsoft Intune license
• Azure AD Premium P1 (for Conditional Access integration)
• Microsoft Defender for Endpoint (for threat-level compliance, optional)

Administrative Access:

• Global Administrator, Intune Administrator, or Policy and Profile Manager role
• Access to Microsoft Intune admin center (intune.microsoft.com)

Technical Requirements:

• Devices enrolled in Intune
• Configuration profiles deployed (if checking for specific configurations)
• Email notification configured (for compliance notifications)

Step 1: Configure Compliance Policy Settings

Before creating individual policies, configure organization-wide compliance settings.

Configure Device Compliance Settings

1. Sign in to the Microsoft Intune admin center: https://intune.microsoft.com

2. Navigate to Devices > Compliance > Compliance policy settings

3. Configure the following settings:

Mark devices with no compliance policy assigned:

• Not compliant: Devices without policies are marked non-compliant (recommended)
• Compliant: Devices without policies are marked compliant (less secure)

Enhanced jailbreak detection (iOS only):

• Enabled: Provides better detection of jailbroken iOS devices
• Uses additional checks beyond standard jailbreak detection

Compliance status validity period (days):

• Default: 30 days
• Devices must check in within this period or become non-compliant
• Recommended: 14-30 days depending on security requirements

4. Click Save

Configure Notification Templates

Create email templates for compliance notifications:

1. Navigate to Devices > Compliance > Notifications

2. Click Create notification

3. Configure the template:

   • Name: "Device Non-Compliance Warning"
   • Subject: "Action Required: Your device is not compliant"
   • Email header: Include company logo (optional)
   • Message body: Explain the compliance issue and remediation steps
   • Email footer: Include support contact information

4. Example message body:

Your device does not meet the security requirements for accessing company resources.

Please take action to resolve the following compliance issues within [number] days:
##NonComplianceReasons##

To check and resolve these issues:
1. Open the Company Portal app on your device
2. Navigate to Devices and select this device
3. Follow the instructions to resolve compliance issues

If you need assistance, contact IT Support at [email protected].

Your access to company email and applications may be restricted until your device is compliant.

5. Click Create

Step 2: Create Windows Compliance Policy

Windows compliance policies can evaluate security features like BitLocker, Defender, and secure boot.

Create the Policy

1. Navigate to Devices > Compliance > Policies

2. Click Create policy

3. Select:

   • Platform: Windows 10 and later
   • Profile type: Windows 10/11 compliance policy

4. Click Create

5. Enter Name: "Windows Security Compliance Policy"

6. Enter Description: "Enforces security requirements for Windows devices"

Configure Compliance Settings

Click Next and configure each category:

Device Health:

Device Properties:

Configuration Manager Compliance:

• Skip unless using co-management with Configuration Manager

System Security:

Microsoft Defender for Endpoint:

Options: Clear, Low, Medium, High

Configure Actions for Noncompliance

1. Click Next to reach Actions for noncompliance

2. The default action "Mark device noncompliant" is always present

3. Click Add to configure additional actions:

4. For Send email to end user:
   • Select your notification template
   • Configure additional recipients (user's manager, IT admins)

Assign the Policy

1. Click Next to reach Assignments

2. Under Included groups, click Add groups

3. Select target groups:

   • "All Windows Devices" (dynamic group)
   • Or specific device groups

4. Under Excluded groups, add any exceptions:

   • Test devices
   • Kiosk devices with different requirements

5. Click Next, review settings, and click Create

Step 3: Create macOS Compliance Policy

macOS compliance policies evaluate Apple-specific security features.

Create the Policy

1. Navigate to Devices > Compliance > Policies

2. Click Create policy

3. Select:

   • Platform: macOS
   • Profile type: macOS compliance policy

4. Click Create

5. Enter Name: "macOS Security Compliance Policy"

Configure Compliance Settings

Device Health:

Device Properties:

System Security - Password:

Encryption:

Device Security:

Microsoft Defender for Endpoint:

Configure Actions and Assign

Follow the same process as Windows:

1. Configure actions for noncompliance with appropriate schedules
2. Assign to macOS device groups
3. Exclude test or special-purpose devices

Step 4: Create iOS/iPadOS Compliance Policy

iOS compliance policies focus on passcode, jailbreak detection, and device health.

Create the Policy

1. Navigate to Devices > Compliance > Policies

2. Click Create policy

3. Select:

   • Platform: iOS/iPadOS
   • Profile type: iOS/iPadOS compliance policy

4. Click Create

5. Enter Name: "iOS Security Compliance Policy"

Configure Compliance Settings

Device Health:

Device Properties:

System Security:

Microsoft Defender for Endpoint:

Configure Actions and Assign

1. Configure actions for noncompliance
2. Assign to iOS device groups
3. Consider separate policies for supervised vs unsupervised devices

Step 5: Create Android Compliance Policy

Android compliance varies based on enrollment type. This covers Android Enterprise.

Create the Policy

1. Navigate to Devices > Compliance > Policies

2. Click Create policy

3. Select:

   • Platform: Android Enterprise
   • Profile type: Select based on enrollment type:
     • Fully managed, dedicated, and corporate-owned work profile (corporate devices)
     • Personally-owned work profile (BYOD)

4. Click Create

5. Enter Name: "Android Enterprise Compliance Policy"

Configure Compliance Settings (Corporate-Owned)

Device Health:

Device Properties:

System Security:

Work Profile Compliance (BYOD)

For personally-owned work profiles, additional settings include:

Step 6: Configure Conditional Access Integration

Compliance policies gain their full power when integrated with Conditional Access.

Create Compliance-Based Conditional Access Policy

1. Navigate to Endpoint security > Conditional Access or use the Azure portal

2. Click Create new policy

3. Configure the policy:

Name: "Require Compliant Device for Office 365"

Assignments:

• Users: All users (exclude emergency access accounts)
• Cloud apps: Office 365

Conditions:

• Device platforms: All platforms or specific platforms
• Client apps: Browser, Mobile apps and desktop clients

Access controls - Grant:

• Select Grant access
• Check Require device to be marked as compliant
• Check Require multifactor authentication (optional but recommended)
• For multiple controls: Require all the selected controls

Session:

• Configure sign-in frequency if needed

4. Enable policy: Start with Report-only, then enable

5. Click Create

Verify Conditional Access Enforcement

1. Test with a non-compliant device:

   • Access should be blocked
   • User sees error message with remediation steps

2. Test with a compliant device:

   • Access should be granted

3. Monitor in Conditional Access insights and sign-in logs

Best Practices

Policy Design

1. Start with baseline policies: Deploy minimum security requirements first
2. Use grace periods: Give users time to remediate before blocking access
3. Test thoroughly: Use Report-only mode for Conditional Access
4. Document requirements: Communicate compliance requirements to users
5. Regular reviews: Audit policies quarterly for relevance

Platform-Specific Recommendations

Windows:

• Always require BitLocker and Secure Boot
• Use Defender for Endpoint integration for threat detection
• Consider TPM requirements for high-security environments

macOS:

• FileVault encryption is essential
• System Integrity Protection should never be disabled
• Gatekeeper prevents unauthorized software installation

iOS/iPadOS:

• Jailbreak detection is critical
• Consider separate policies for supervised devices
• Balance security with user experience for passcode requirements

Android:

• Require SafetyNet attestation
• Security patch requirements help maintain device security
• Consider work profile password separate from device password

Notification Strategy

1. Warn before blocking: Send emails before restricting access
2. Clear instructions: Include specific remediation steps
3. Support information: Provide IT contact details
4. Escalation path: Include manager notifications for extended non-compliance

Troubleshooting

Device Showing Non-Compliant

Symptoms: Device appears non-compliant in Intune.

Diagnosis:

1. In Intune, go to Devices > All devices
2. Select the device > Device compliance
3. Review which settings are non-compliant
4. Check Per-setting status for specific issues

Common Causes and Solutions:

Compliance Status Not Updating

Symptoms: Device compliance status appears stale.

Solutions:

1. On the device, open Company Portal and sync manually
2. For Windows, run: Invoke-IntuneSyncCycle in PowerShell
3. Wait for next scheduled check-in (up to 8 hours)
4. Restart the Intune Management Extension service (Windows)

Conditional Access Blocking Compliant Devices

Symptoms: Compliant devices are still blocked by Conditional Access.

Solutions:

1. Verify device appears as compliant in Intune
2. Check Azure AD device record matches Intune
3. Use Conditional Access What If tool to diagnose
4. Review sign-in logs for specific error codes
5. Verify device is Azure AD registered/joined

Policy Not Applying to Devices

Symptoms: Compliance policy not evaluating devices.

Solutions:

1. Verify policy is assigned to correct groups
2. Check device is in an assigned group
3. Review Assignment status in policy details
4. Verify no conflicting exclusions
5. Force device sync and wait 15-30 minutes

Monitoring and Reporting

Built-in Reports

Access compliance reports in Intune:

1. Navigate to Devices > Monitor

2. Review available reports:

   • Noncompliant devices: Devices failing compliance
   • Devices without compliance policy: Unassigned devices
   • Setting compliance: Per-setting compliance rates

Custom Reporting

1. Navigate to Reports > Device compliance

2. Generate reports:

   • Policy compliance: Per-policy compliance rates
   • Setting compliance: Specific setting compliance
   • Device compliance trend: Historical compliance data

3. Export reports for further analysis or executive reporting

Compliance Dashboard

1. Navigate to Devices > Overview

2. Review compliance widgets:

   • Device compliance status: Pie chart of compliance
   • Device compliance trend: Line graph over time
   • OS distribution: Breakdown by platform

Next Steps

After configuring compliance policies:

1. Enable Conditional Access: Enforce compliance requirements for resource access
2. Configure remediation: Deploy configuration profiles to auto-remediate settings
3. Set up alerts: Create notifications for compliance policy failures
4. User communication: Send guides on maintaining device compliance
5. Regular audits: Review compliance rates and adjust policies

Additional Resources

• Microsoft Intune Compliance Policy Documentation
• Conditional Access and Intune Compliance
• Compliance Policy Settings Reference

Need help with your Intune compliance strategy? InventiveHQ offers comprehensive Microsoft Endpoint Manager consulting, including compliance policy design and Zero Trust implementation. Contact us for a free consultation.