What this check looks at
Checks the Intune setting that decides how a device with no compliance policy assigned is marked: compliant, or not compliant.
Intune has a tenant-wide setting, Mark devices with no compliance policy assigned as, under Devices > Compliance > Compliance settings. Out of the box it is set to Compliant: a device under Intune management that has no compliance policy assigned to it, or to its user, is reported to Microsoft Entra ID as compliant.
This check reads that setting. The check fails when it is set to Compliant and passes when it is set to Not compliant.
Conditional Access policies that require a compliant device take Intune’s verdict as final. With the default, any device that falls outside every policy’s assignment (a platform nobody wrote a policy for, a user missing from the targeted group, a policy assigned to a group that was later emptied) passes as compliant without any check of encryption, operating system version or jailbreak status. The control meant to keep unhealthy devices out lets them in.
Why it matters
Out of the box, Intune marks a device with no compliance policy as compliant. Conditional Access that requires a compliant device then lets in any enrolled device nobody has set rules for, which defeats the point of requiring one.
A typical case: a 90-person firm requires compliant devices for Microsoft 365 and has compliance policies for Windows and iOS only. A member of staff puts a personal Android phone under Intune management; there is no Android policy, so Intune reports it compliant. The phone is rooted, runs an Android release years out of support and carries malware that captures the screen, including the finance team’s supplier payment approvals in Outlook.
Changing the setting costs nothing once every device has a policy, and it makes compliance fail safe: a device is trusted only when a policy has positively checked it.
CIS Microsoft 365 Foundations Benchmark 4.1 asks for devices without a compliance policy to be marked not compliant. CIS Controls v8 safeguard 4.1, ISO 27001 A.8.1 and A.8.9, the NCSC CAF device management and secure configuration outcomes, and NIST CSF PR.PS-01 expect a secure configuration to be checked on every device, not assumed.
How to fix it
Where: Intune admin centre → Devices → Compliance → Compliance settings
Before you start
- In Intune → Devices → Monitor → Device compliance, find devices with "No compliance policy assigned" and assign them a policy first, or they become non-compliant straight away.
- Check which Conditional Access policies require a compliant device, so you know who could be blocked.
Step by step
- Find devices with no compliance policy. In the Microsoft Intune admin centre, open Devices > Monitor > Devices without compliance policy. Export the list and note each device’s platform and user.
- Assign policies to cover them. For each platform in that list, check Devices > Compliance > Policies has a policy for it and create one if not (see the compliance policy coverage finding). Assign every compliance policy to All users or All devices rather than a pilot group, so no device falls outside.
- Check who could be blocked. In the Microsoft Entra admin centre, Entra ID > Conditional Access > Policies, note which policies require a compliant device. Users of any device still listed without a policy will be blocked by them once the setting changes.
- Change the setting. In the Intune admin centre go to Devices > Compliance and open the Compliance settings tab. Set Mark devices with no compliance policy assigned as to Not compliant, leave Compliance status validity period (days) at 30, and select Save.
- Watch the first day. Recheck Devices > Monitor > Devices without compliance policy: it should be empty. Watch the sign-in logs and the helpdesk queue for anyone blocked, and assign a policy to their device rather than reverting the setting.
- Confirm the setting. Reopen Devices > Compliance > Compliance settings and check Mark devices with no compliance policy assigned as shows Not compliant. The finding clears at the next assessment.
What users will notice
Devices with no compliance policy become not compliant, and Conditional Access that requires a compliant device blocks them until a policy is assigned.
How to confirm it worked
Intune admin centre → Devices → Compliance → Compliance settings shows "Mark devices with no compliance policy assigned as: Not compliant".
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| NCSC CAF | B2.b Device managementB4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PV-4 Audit and enforce secure configurations for compute resources |
| Zero Trust | Endpoints |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious software |
| PCI DSS 4.0.1 | 2.2.1 Configuration standards are developed, implemented and maintained |
| NIST SP 800-171 | 3.4.2 Establish and enforce security configuration settings |
| CMMC Level 2 | CM.L2-3.4.2 Security Configuration Enforcement |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.8.9 Configuration management |
| CIS M365 | 4.1 Ensure devices without a compliance policy are marked 'not compliant' |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Compliance policy settings in Intune (Microsoft Learn)