Intune Compliance Policies: A Practical Configuration Guide

Compliance policies are what feed device health status into conditional access. A device that fails compliance can be blocked from accessing email or SharePoint regardless of whether the user’s credentials are valid. Getting the policy itself right matters more than people expect, since an overly strict policy locks out legitimate users while a lax one defeats the purpose entirely.

Start with the settings that actually matter

Minimum OS version, encryption requirement (BitLocker on Windows, device encryption on mobile), a password/PIN requirement, and jailbreak/root detection cover the majority of realistic risk for most organisations. Resist the urge to enable every available compliance check on day one. A policy with 20 checks where several are misconfigured is worse than a policy with 5 checks that are all correct and well understood.

Set a grace period for new enrollments

Configure the “mark device noncompliant” schedule to allow a reasonable grace period (a few days is typical) rather than instantly, giving a newly enrolled device time to actually receive and apply the policies that will make it compliant before being blocked from resources it needs to finish provisioning.

Connect compliance to conditional access deliberately

Compliance policies alone don’t block anything. They just set a device’s status. It’s a conditional access policy (in Entra ID) requiring “device marked as compliant” that actually enforces access restrictions based on that status. Build and test the conditional access policy against a pilot group before applying broadly, since a mistake here can lock out an entire user population from email simultaneously.

Give users a way to understand and fix non-compliance

Configure custom noncompliance messages in the policy (with actionable instructions specific to each check) rather than leaving users with Intune’s generic default text. A user told exactly why their device is noncompliant and how to fix it resolves the issue themselves far more often than one left to guess.

For official guidance, see Microsoft’s Intune documentation.