Skip to main content

087: Compliance policy

Implementation Effort: Medium
User Impact: High

Overview​

Compliance policies in Microsoft Intune decide whether a device meets your organization's minimum security requirements. They typically evaluate properties such as PIN or password strength, encryption, jailbreak or root state, minimum OS version, Microsoft Defender for Endpoint risk, and other device health signals. For Zero Trust, compliance status is a key decision point rather than a reporting artifact. Devices that are not compliant should not retain the same access to sensitive data and applications as devices that continue to meet the approved baseline.

Implementation Guidance​

  1. Create separate compliance policies by platform and, where needed, by ownership model. Personally owned Android Enterprise work profile devices often need a different baseline than fully managed corporate devices.
  2. Include core health requirements such as screen lock, encryption, OS version floor, blocked compromised-device states, and device risk integration with Microsoft Defender for Endpoint or another approved provider.
  3. Set realistic remediation and grace-period actions. Marking a device noncompliant immediately may be right for high-risk findings, while older OS versions may justify a short remediation window.
  4. Pair compliance with Conditional Access so access decisions enforce the baseline for Exchange, SharePoint, Teams, and other business apps.
  5. Exclude only tightly controlled break-glass or exception groups, and document why each exception exists and when it expires.
  6. Review compliance reports regularly and use them to find policy drift, outdated devices, and populations that need lifecycle or enrollment changes.

Reference​