メインコンテンツへスキップ

137: Compliance Policy

Implementation Effort: Medium — the controls are straightforward to configure, but the policy decisions have direct access-control consequences.

User Impact: Medium — noncompliant devices may lose access to corporate resources, so user messaging and remediation paths matter.

Overview​

Compliance policies are one of the most important device signals in a Zero Trust architecture. Microsoft Intune evaluates whether devices meet your required state, such as minimum OS version, encryption, password requirements, Secure Boot, Microsoft Defender health, or risk posture from integrated security tooling. Microsoft Entra Conditional Access can then use the resulting compliance signal to allow, limit, or block access to corporate resources.

Implementation Guidance​

  • Define the minimum security controls per platform and per sensitivity tier. Typical starting points include encryption, OS minimum versions, Microsoft Defender status, device threat level, and jailbreak or root detection where applicable.
  • Create separate compliance policies for major platform or ownership differences instead of forcing one policy to fit every device class.
  • Configure actions for noncompliance intentionally, including grace periods, user notifications, and whether immediate access loss is appropriate for each policy breach.
  • If licensed, integrate Microsoft Defender for Endpoint device risk signals so access decisions can reflect both configuration state and active threat posture.
  • Use Conditional Access to require devices to be marked compliant for high-value apps and data, while preserving emergency or break-glass access paths for true business continuity scenarios.
  • Review compliance reports regularly and tune policies when false positives, unsupported hardware, or business exceptions create unnecessary friction.

Reference​