What this check looks at
Measures the share of enrolled devices currently reporting as compliant.
Intune marks each managed device compliant or not compliant against its compliance policies and against built-in checks, such as whether it has checked in within the compliance status validity period (30 days by default). Not compliant is the organisation’s own verdict that the device is not fit to hold company data, and it stays that way until the device is fixed, checks in again or is removed.
This check measures the share of Intune-managed devices currently reported compliant. It passes at 95 per cent or more and warns between 80 and 95 per cent. The check fails when fewer than 80 per cent of managed devices are compliant. The evidence breaks the devices down by compliance state (compliant, noncompliant, in grace period, error, unknown and so on).
A large non-compliant tail usually has one of three causes: a setting devices cannot meet (a minimum OS version newer than the hardware supports, BitLocker required on Windows Home), devices that stopped checking in but were never retired, or a fleet that is genuinely unpatched or unencrypted. Either way compliance stops meaning anything: if Conditional Access requires it, a fifth of staff are blocked or excluded; if it does not, risky devices carry on unnoticed.
Why it matters
Non-compliant devices are, by the organisation's own definition, not fit to hold company data. A persistent tail of them usually means a policy nobody can meet, or a fleet nobody is patching.
A typical case: a 200-person housing association finds 35 per cent of devices non-compliant. Most fail a minimum OS version that was raised without checking, and 40 are laptops returned by leavers but never retired. Hidden in the noise are twelve laptops with BitLocker suspended after a firmware update, one of which is later lost on a train with tenants’ personal data on it.
Getting above 95 per cent turns compliance into a reliable signal: a compliant-device Conditional Access policy can then be enforced without blanket exceptions, and the question “was the lost laptop encrypted?” can be answered with evidence.
Cyber Essentials’ secure configuration requirement, CIS Controls v8 safeguard 4.1, ISO 27001 A.8.1 and the NCSC CAF device management outcome expect device standards to be met in practice, not just defined. NIST CSF PR.PS-02 asks for software to be maintained.
How to fix it
Where: Intune admin centre → Reports → Device compliance
Before you start
- Look at the non-compliant devices by reason in Intune; one failing setting often explains most of them.
Step by step
- Group the failures by reason. In the Microsoft Intune admin centre, go to Reports > Device compliance, open the Reports tab and run Noncompliant devices and settings. Export it and group the devices by failing setting; one or two settings usually explain most of the list.
- Check the failing settings are achievable. For the top failing settings, open the policy under Devices > Compliance > Policies and look at Per-setting status. If many devices cannot meet a setting (for example a minimum OS version newer than the hardware supports, or BitLocker on Windows Home), correct the policy or plan the hardware change, rather than leaving devices permanently non-compliant.
- Sync devices that are probably fine. Open Devices > All devices, select Bulk device actions, choose the platform and Sync, and select the non-compliant devices (or use Sync on each device’s page). Devices that were simply offline often report compliant once they check in.
- Retire devices that no longer exist. Devices that have not checked in for more than 30 days are usually returned, replaced or lost. Confirm with the client, then select Retire (or Wipe for a lost company device) and Delete in Intune, and remove the matching record in the Microsoft Entra admin centre under Entra ID > Devices > All devices.
- Fix the remaining devices one by one. For each remaining device, its Device compliance page shows the failing setting. Common fixes: install pending Windows updates and restart; resume or turn on BitLocker (the disk encryption policy can do this); update iOS; remove a jailbroken or rooted phone from use. Raise a ticket with each user and agree a date.
- Tell users what to do automatically. Add a Send email to end user action to each compliance policy (the policy > Properties > Actions for noncompliance) with a notification template from Devices > Compliance > Notifications, so people receive the reason and the fix as soon as their device falls out of compliance.
- Confirm the compliance rate. Re-run the Device compliance report: compliant devices should be 95 per cent or more of managed devices, and the rest should be devices actively being fixed. The finding clears at the next assessment.
What users will notice
Owners of non-compliant devices may need to update, restart or encrypt their device.
How to confirm it worked
Intune, Devices, Monitor, Noncompliant devices: the list is down to devices being actively fixed.
Frameworks and controls
This check maps to controls in 15 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | Secure configuration |
| Cyber Essentials Plus | Secure configuration |
| NCSC CAF | B2.b Device management |
| DSPT | Standard 9: IT protection |
| NIS2 | Art. 21(2)(e) Security in acquisition, development and maintenance, including vulnerability handling |
| Microsoft Cloud Security Benchmark | PV-4 Audit and enforce secure configurations for compute resources |
| Zero Trust | Endpoints |
| SOC 2 | CC7.1 Detecting configuration changes and vulnerabilities |
| PCI DSS 4.0.1 | 2.2.1 Configuration standards are developed, implemented and maintained |
| NIST SP 800-171 | 3.4.2 Establish and enforce security configuration settings |
| CMMC Level 2 | CM.L2-3.4.2 Security Configuration Enforcement |
| ISO 27001:2022 | A.8.1 User endpoint devices |
| CIS Controls v8.1 | 4.1 Establish and maintain a secure configuration process (IG1) |
| NIST CSF 2.0 | PR.PS-02: Software is maintained, replaced, and removed commensurate with risk |
| NCSC 10 Steps | Architecture and configuration |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Monitor device compliance (Microsoft Learn)