📖 What is Compliance Policies (Intune)?
Compliance Policies are rules defined in Microsoft Intune that determine whether a device is compliant based on specific security settings. Non-compliant devices can be blocked from accessing corporate resources via integration with Conditional Access.
"Sensei says: Compliance policies mark a device as compliant; they do not configure the device. Configuration profiles do the actual setting."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Compliance Policies (Intune)?
- ▸ Integration with Azure AD Conditional Access allows administrators to block access to corporate data if a device fails to meet defined compliance requirements.
- ▸ Policies are platform-specific, meaning separate rules must be created for Windows, macOS, iOS, and Android to ensure consistent security across all endpoints.
- ▸ Compliance actions define the response to non-compliance, such as sending a notification to the user or immediately marking the device as non-compliant.
- ▸ The evaluation process involves the Intune agent reporting the device state to the cloud, which then compares it against the assigned policy rules.
- ▸ Unlike configuration profiles, compliance policies are passive observers that report status rather than actively pushing settings to change the device configuration.
🎯 How does Compliance Policies (Intune) appear on the MS-102 Exam?
You may be asked to design a solution that prevents rooted or jailbroken mobile devices from accessing Exchange Online, requiring a combination of Intune compliance policies and Conditional Access.
A scenario might describe a need to ensure all corporate laptops have a minimum OS version before accessing SharePoint; you must identify the compliance policy as the mechanism for verification.
Expect questions where you must distinguish between using a configuration profile to enforce a password and using a compliance policy to verify that a password is set.
❓ Frequently Asked Questions
Can I use a compliance policy to automatically fix a setting on a device?
No. Compliance policies only evaluate and report the state of a device. To actually change a setting or enforce a configuration, you must use an Intune Configuration Profile.
What is the relationship between the compliance policy and the 'Mark device non-compliant' action?
The 'Mark device non-compliant' action is the trigger that changes the device status in Azure AD, which then allows Conditional Access policies to block the user's access.
How does Intune handle devices that are not managed by Intune but need to be compliant?
For unmanaged devices, you can use 'Compliance policy settings' to mark devices as compliant if they are joined to a local Active Directory domain via Hybrid Azure AD join.