Compliance policies¶

A compliance policy describes what a trustworthy device looks like: encrypted, up to date, not jailbroken, protected by Defender. Intune evaluates each device against its policies and writes the result to the device object in Entra ID, where Conditional Access uses it to allow or block access.

Create policies under Devices > Manage devices > Compliance.

Tenant-wide compliance settings¶

Before writing any policy, set these two values under Endpoint security > Device compliance > Compliance policy settings:

Intune also applies a built-in device compliance policy to every device. It checks that the device has a compliance policy assigned, that it's been in contact with Intune within the validity period, and that the enrolled user still exists and has a license.

What to require, per platform¶

These are sensible starting points. Tighten them as your estate allows.

Actions for noncompliance and grace periods¶

Each policy has actions for noncompliance. The first action, Mark device noncompliant, has a schedule in days. That schedule is your grace period: during it, the device shows In grace period and keeps its access.

How the overall status is decided¶

A device can have several compliance policies. Intune combines their results by severity, and the most severe wins:

If a setting reports Error, the device keeps its previous compliance state for up to seven days while Intune retries. After seven days of errors it becomes noncompliant, or enters the grace period if the policy has one.

Custom compliance (Windows and Linux)¶

When Intune doesn't have the check you need, custom compliance lets you write it. You provide two things:

1. A discovery script (PowerShell on Windows, POSIX shell on Linux) that returns the values to check as compact JSON. Add it under Devices > Manage devices > Compliance > Scripts.
2. A JSON rules file that says what each value must be, plus the message users see if it fails. Upload it in the compliance policy under Custom Compliance.

# Report the installed version of a security agent, or 0.0.0 if it's missing.
$key = 'HKLM:\SOFTWARE\Contoso\SecurityAgent'
$version = (Get-ItemProperty -Path $key -Name 'Version' -ErrorAction SilentlyContinue).Version
if (-not $version) { $version = '0.0.0' }

$result = @{ AgentVersion = $version }
return $result | ConvertTo-Json -Compress

{
  "Rules": [
    {
      "SettingName": "AgentVersion",
      "Operator": "GreaterEquals",
      "DataType": "Version",
      "Operand": "7.2.0",
      "MoreInfoUrl": "https://intranet.contoso.com/security-agent",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Your security agent is out of date",
          "Description": "Install the latest security agent from Company Portal, then select Check status."
        }
      ]
    }
  ]
}

Supported operators include IsEquals, NotEquals, GreaterThan, GreaterEquals, LessThan and LessEquals. Data types include Boolean, Int64, Double, String, DateTime and Version.

Monitoring compliance¶

Users can check and refresh their own status in Company Portal (Devices > Check status), which triggers a fresh evaluation.

Learn more¶

• Use compliance policies
• Create a compliance policy
• Monitor device compliance
• Custom compliance settings