Intune Compliance Policies define what a 'healthy' device looks like and feed into Conditional Access to block non-compliant devices from accessing company data. Here's how to set them up correctly.
Key takeaways
- 1Operating system version — minimum OS version to prevent access from unsupported, unpatched systems
- 2Password requirements — minimum complexity, length, and expiry
- 3Encryption — BitLocker on Windows, FileVault on Mac must be enabled
- 4Antivirus status — active and up to date antivirus required
- 5Firewall status — Windows firewall must be enabled
Intune Compliance Policies are the rules that define whether a device is considered healthy and trusted. They're the link between device management and access control — a non-compliant device can be blocked from accessing Microsoft 365 apps via Conditional Access.
What compliance policies check
- Operating system version — minimum OS version to prevent access from unsupported, unpatched systems
- Password requirements — minimum complexity, length, and expiry
- Encryption — BitLocker on Windows, FileVault on Mac must be enabled
- Antivirus status — active and up to date antivirus required
- Firewall status — Windows firewall must be enabled
- Secure Boot — UEFI Secure Boot enabled
- Defender for Business active — endpoint protection running and reporting to the portal
Grace periods and non-compliance actions
When a device goes out of compliance, you don't have to immediately block access. Intune lets you configure non-compliance actions: send the user an email notification on day one, mark the device non-compliant (and trigger CA block) on day three, and retire the device from management after 30 days of non-compliance. This gives users time to resolve issues without a hard outage.
Platform-specific policies
Compliance policies are platform-specific — you configure separate policies for Windows, macOS, iOS, and Android. Optimyze maintains separate policy templates for each platform, tailored for business use (stricter for corporate-owned devices, slightly relaxed for BYOD with App Protection Policies applied).
