059: Compliance policy

Implementation Effort: Medium

User Impact: Medium

Overview

Device compliance policies in Microsoft Intune define the minimum security and health requirements a device must meet before the organization trusts it for resource access. In a Zero Trust model, compliance is one of the most important signals used with Conditional Access to decide whether a device should be allowed to reach Microsoft 365 or other protected services.

For Apple devices, compliance policy should reflect both your security baseline and what the platform can reliably report.

Implementation Guidance

1. Build compliance policy around a small set of meaningful controls such as supported OS version, device integrity, password or passcode expectations, encryption state where supported, and mobile threat or device-risk posture if you use Microsoft Defender for Endpoint.
2. In the Microsoft Intune admin center, create platform-specific compliance policies rather than trying to force the same exact rule set across every device type.
3. Define what happens when devices become noncompliant: grace period, end-user notifications, and escalation path for security-sensitive populations.
4. Pair compliance with Conditional Access so protected resources require a compliant device where that model is appropriate.
5. Pilot with realistic user groups and validate common failure cases such as old OS versions, jailbroken devices, missing required apps, or delayed check-in.
6. Review the compliance reports regularly and retire settings that no longer provide value or are consistently confusing to users.

Reference

• Create a compliance policy for iOS/iPadOS in Microsoft Intune
• Device compliance policies in Microsoft Intune - Microsoft Intune — Provides Intune compliance policy concepts and setup guidance for managed devices.
• Use Conditional Access with Microsoft Intune compliance policies - Microsoft Intune — Explains how Intune compliance policies integrate with Microsoft Entra Conditional Access.