126: Compliance Policies (Client-Driven Evaluation & AI Agent Checks)
Implementation Effort: Medium – Requires defining platform compliance baselines, conditional access integration, and remediation notifications.
User Impact: Medium – Noncompliant devices are restricted from accessing organizational resources via Microsoft Entra Conditional Access until remediated.
Overview
Windows Compliance Policies in Microsoft Intune define the security posture rules and conditions that managed devices must meet before Microsoft Entra Conditional Access grants access to organizational resources.
Recent 2026 enhancements significantly strengthen Zero Trust posture evaluation:
- Client-Driven Compliance Evaluation for Windows (September 2026): Supported Windows devices now proactively detect local changes to critical security signals—including Firewall, Antivirus, BitLocker, Microsoft Defender status, OS build, Real-time protection, and Secure Boot—and immediately request compliance re-evaluation rather than waiting for a scheduled 8-hour check-in. This drastically reduces the window of exposure when a security control is disabled or remediated.
- Mark Devices Noncompliant When Prohibited AI Agents Are Discovered: Admins can configure a list of prohibited local AI agents (such as OpenClaw) in a Windows compliance policy. When an unsanctioned local agent is detected on the endpoint, the device is automatically marked noncompliant and blocked by Conditional Access until the agent is removed.
- Device-Reported Values Guidance: Compliance reports include device-reported setting values for rapid triage while maintaining server-side verification for access decisions.
This directly supports Verify explicitly by continuously validating real-time endpoint security posture and Assume breach by immediately revoking access via Conditional Access when local security controls or prohibited AI agent rules are violated.