What this check looks at
Checks that at least one Intune device compliance policy is configured, per platform in use.
An Intune device compliance policy is the organisation’s definition of a healthy device: disk encrypted, operating system at or above a minimum version, firewall and antivirus on, not jailbroken or rooted, a passcode set. Intune evaluates each managed device against the policies assigned to it and reports it to Microsoft Entra ID as compliant or not compliant. A tenant licensed for Intune starts with no compliance policies at all.
This check applies where the tenant holds an Intune service plan and counts the compliance policies configured. The check fails when there are none. It warns when there are only one or two, because at least one of Windows, macOS, iOS/iPadOS and Android is then probably not covered, and passes at three or more.
Without a policy, managed devices are judged only by Intune’s built-in checks, and by default a device with no policy is reported as compliant (see the related finding on that setting). A Conditional Access policy that requires a compliant device then admits unencrypted, unpatched or jailbroken devices, there is no report of which devices fall short, and a lost laptop cannot be shown to have been encrypted.
Why it matters
Without compliance policies the tenant has no definition of a "healthy" device, so Conditional Access cannot distinguish a managed corporate laptop from an unpatched machine in an internet café.
A typical case: a 45-person architecture practice requires compliant devices in Conditional Access but never created compliance policies. A partner’s personal laptop, brought under Intune to get email, has no disk encryption and is several Windows releases behind. It is stolen from a car with project files and client personal data synced to it; the practice cannot show it was protected, so it has to treat the loss as a personal data breach and consider reporting it to the ICO.
Compliance policies cost nothing beyond the Intune licence already paid for, and on their own they change nothing for users. They become a control when Conditional Access requires a compliant device, which is the next step.
Cyber Essentials’ secure configuration requirement, CIS Controls v8 safeguard 4.1 (secure configuration process), ISO 27001 A.8.1 (user endpoint devices) and A.8.9 (configuration management), and the NCSC CAF device management and secure configuration outcomes all expect a defined and enforced standard for devices that reach company data. NIST CSF PR.PS-01 asks for configuration management practices to be established and applied.
How to fix it
Where: Intune admin centre → Devices → Compliance policies
Before you start
- List the platforms in use (Windows, macOS, iOS, Android) from Intune, Devices.
- Start with Microsoft’s recommended settings and mark devices non-compliant only after a grace period.
Step by step
- List the platforms in use. In the Microsoft Intune admin centre, go to Devices > All devices and sort or filter by OS to see which platforms are managed: Windows, macOS, iOS/iPadOS, Android Enterprise. Note any platform with devices but no policy under Devices > Compliance > Policies.
- Create the Windows compliance policy. Go to Devices > Compliance > Policies > Create policy, Platform: Windows 10 and later. Under Device Health require BitLocker and Secure Boot; under Device Properties set a minimum OS version matching the oldest Windows release you support; under System Security require encryption of data storage on device, firewall, antivirus, antispyware, and Microsoft Defender Antimalware with real-time protection. Assign it to All users (or All devices) and select Create.
- Create the iOS/iPadOS compliance policy. Create policy, Platform: iOS/iPadOS. Under Device Health set Jailbroken devices to Block; under Device Properties set a minimum OS version; under System Security require a passcode with a sensible minimum length and a short auto-lock time. Assign it to All users.
- Create the Android Enterprise compliance policy. Create policy, Platform: Android Enterprise, choosing the profile type that matches how phones are set up (personally-owned work profile, or fully managed, dedicated and corporate-owned work profile). Set Rooted devices to Block, require the Play Integrity basic and device integrity checks, set a minimum OS version, and require encryption and a passcode. Assign it to All users.
- Create the macOS compliance policy. Create policy, Platform: macOS. Require System Integrity Protection, encryption of data storage on device (FileVault) and the firewall, set a minimum OS version, and set Gatekeeper to allow apps from the Mac App Store and identified developers. Assign it to All users.
- Set a grace period and user notification. In each policy’s Actions for noncompliance, keep Mark device noncompliant but set the schedule to two or three days after noncompliance, and add Send email to end user with a notification template (Devices > Compliance > Notifications), so people are told what to fix before anything depends on it.
- Review the first results. After devices check in (within about eight hours, or select Sync on a device), open each policy under Devices > Compliance > Policies and review Device status and Per-setting status. Correct any setting that no device can meet before a Conditional Access policy relies on it.
- Confirm every platform is covered. Devices > Compliance > Policies should show an assigned policy for every platform in use, and Reports > Device compliance should show every managed device evaluated. Then plan the Conditional Access policy that requires a compliant device (see that finding). This finding clears at the next assessment.
What users will notice
None until compliance is required by Conditional Access. Users of non-compliant devices may see notifications in Company Portal.
How to confirm it worked
Intune, Devices, Compliance policies: a policy is assigned for each platform, and Device compliance shows every managed device evaluated.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Secure configuration |
| Cyber Essentials Plus | Secure configuration |
| NCSC CAF | B2.b Device managementB4.b Secure configuration |
| DSPT | Standard 9: IT protection |
| DORA | Art. 9 Protection and prevention |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | PV-4 Audit and enforce secure configurations for compute resources |
| Zero Trust | Endpoints |
| SOC 2 | CC6.8 Preventing or detecting unauthorised or malicious softwareCC7.1 Detecting configuration changes and vulnerabilities |
| PCI DSS 4.0.1 | 2.2.1 Configuration standards are developed, implemented and maintained |
| NIST SP 800-171 | 3.4.2 Establish and enforce security configuration settings |
| CMMC Level 2 | CM.L2-3.4.2 Security Configuration Enforcement |
| ISO 27001:2022 | A.8.1 User endpoint devicesA.8.9 Configuration management |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.PS-01: Configuration management practices are established and applied |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Get started with device compliance (Microsoft Learn)