How do Intune compliance policies work with Conditional Access?

Key facts

• Compliance policies evaluate; Conditional Access enforces.
• Devices must be enrolled in Intune to be marked compliant.
• Noncompliance actions can include a grace period before the device is marked noncompliant.
• The tenant setting for devices with no compliance policy should be not compliant.
• Run Conditional Access in report-only mode before enforcing device compliance.

How the pieces connect

Microsoft Intune evaluates each enrolled device against the compliance policies assigned to it and writes a compliance state to the device object in Microsoft Entra ID. When a user signs in, Conditional Access reads that state. If a policy requires a compliant device and the device is not compliant, or not known to Intune at all, access is blocked or limited.

This is how Microsoft 365 moves from trusting the user to trusting the user on a known, healthy device. It stops stolen credentials being used from an attacker's laptop and stops data landing on unmanaged personal computers.

What compliance policies can check

Compliance policies are created per platform in the Intune admin center under Devices, Compliance. Keep them focused on security posture, not configuration; configuration belongs in configuration profiles.

• Integrate Microsoft Defender for Endpoint to use its device risk score as a compliance signal.
• Use custom compliance scripts on Windows for checks not covered by built-in settings.

Actions for noncompliance and tenant settings

Each compliance policy has actions for noncompliance. The default marks the device noncompliant immediately. Add a grace period of a few days for settings users can fix themselves, such as an OS update, and send an email or push notification with instructions. You can also remotely lock or retire devices that stay noncompliant.

Check the compliance policy settings for the tenant. Set devices with no compliance policy assigned to be marked not compliant, so nothing slips through untested. The compliance status validity period controls how long a device can go without checking in before it is treated as noncompliant.

Building the Conditional Access policy

In the Entra admin center, create a policy targeting users and the apps you want to protect, often all resources, with the grant control require device to be marked as compliant. For a hybrid estate, you can allow require compliant device or require Microsoft Entra hybrid joined device during a transition.

Exclude emergency access accounts and plan for the Intune enrollment flow, so new devices can enroll before they are compliant. For personal phones, pair the policy with require app protection policy on iOS and Android, so users can reach mail and Teams through managed apps without enrolling the device.

Roll out without locking people out

Turn on the compliance policies first and watch the compliance reports for a couple of weeks. Fix the common failures, such as BitLocker not enabled or devices behind on updates, before anyone is blocked.

Then run the Conditional Access policy in report-only mode and use the sign-in logs and the Conditional Access insights workbook to see who would be affected. Enforce in waves by group, starting with IT. Tell users what compliant means and how to fix their device through Company Portal.

How Accred Consulting approaches it

Accred Consulting builds device compliance and Conditional Access together, because each depends on the other. Discovery reviews enrollment coverage, platforms, Defender integration and current Conditional Access. The proposal sets a clear scope, fixed price and timeline. US-based specialists then design compliance policies per platform, set grace periods and notifications, fix common failures, and enforce require compliant device in waves after report-only testing. A roughly 280-device estate across 11 locations moved to Autopilot and Intune this way. Handover includes documentation and knowledge transfer.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions