Intune compliance policies are only valuable if you have a plan for what happens when a device fails them. Here's how to configure graceful non-compliance actions without disrupting business.
Key takeaways
- 1Day 0: Mark device non-compliant — the device is flagged in the Intune portal but access isn't blocked yet
- 2Day 1: Send email notification — user receives an automated email explaining what's out of compliance and how to fix it
- 3Day 3: Conditional Access blocks access — if not remediated, the device can no longer access Microsoft 365 apps
- 4Day 30: Retire device — if the device has been non-compliant for 30 days, it's removed from management (company data wiped, enrolment removed)
Intune compliance policies define what a healthy device looks like. But the real-world question is: what happens when a device fails? Get this wrong and you lock users out of company data for an out-of-date OS version. Get it right and you have a managed, graceful process that maintains security without disrupting business.
Non-compliance actions in Intune
Intune's non-compliance actions are a sequence of escalating responses:
- Day 0: Mark device non-compliant — the device is flagged in the Intune portal but access isn't blocked yet
- Day 1: Send email notification — user receives an automated email explaining what's out of compliance and how to fix it
- Day 3: Conditional Access blocks access — if not remediated, the device can no longer access Microsoft 365 apps
- Day 30: Retire device — if the device has been non-compliant for 30 days, it's removed from management (company data wiped, enrolment removed)
Tuning grace periods for your business
The right grace period depends on your risk tolerance and workforce. For a clinical healthcare environment, you may want a shorter window (block after 1 day for missing antivirus). For a knowledge-work business with a distributed team in different time zones, you may want a longer window (block after 5 days for an OS version issue). Optimyze configures grace periods appropriate to each client's sector and risk profile.
The helpdesk workflow when devices go non-compliant
Optimyze monitors Intune compliance status as part of 24/7 operations. When a device goes non-compliant, the Optimyze helpdesk proactively contacts the user on day one — often before they've received the automated email. In most cases, the issue is an available but uninstalled OS update or an expired device password, resolved in a single support interaction.
