📖 What is Microsoft Intune Compliance Policies?
Microsoft Intune Compliance Policies are a set of rules that define the minimum security requirements a device must meet to be considered compliant. If a device fails these requirements, such as lacking a password or being jailbroken, it can be blocked from accessing corporate data.
"Remember that compliance policies do not 'fix' the device; they simply report its status, which then triggers Conditional Access actions."
📚 Certification: Microsoft 365 Administrator (MS-102)
🔑 What are the Key Concepts of Microsoft Intune Compliance Policies?
- ▸ Integration with Azure AD Conditional Access allows administrators to block access to corporate resources for any device marked as non-compliant by Intune.
- ▸ Platform-specific rules enable tailored security requirements for Windows, macOS, iOS, and Android, ensuring a consistent security posture across a diverse device fleet.
- ▸ Compliance policies focus on reporting and auditing device state rather than enforcing settings, acting as a sensor for the overall security health.
- ▸ Custom compliance scripts allow organizations to evaluate specific registry keys or files on Windows devices that are not covered by built-in settings.
- ▸ The compliance status is periodically evaluated based on a defined schedule, ensuring that devices that fall out of compliance are quickly identified.
🎯 How does Microsoft Intune Compliance Policies appear on the MS-102 Exam?
You may be asked to design a solution where users must have a minimum OS version to access SharePoint; you would create a compliance policy and link it to a Conditional Access policy.
A scenario might describe a need to prevent rooted Android devices from accessing corporate email; expect to identify the specific compliance setting for 'Rooted' or 'Jailbroken' status.
Expect questions where you must distinguish between using a Configuration Profile to enforce a password and a Compliance Policy to verify that a password is set.
❓ Frequently Asked Questions
What is the fundamental difference between a Configuration Profile and a Compliance Policy?
Configuration Profiles are used to 'push' and enforce settings (e.g., set a password length), whereas Compliance Policies 'check' if those settings are present and report the status to Azure AD.
Can a Compliance Policy automatically fix a device that is non-compliant?
No, compliance policies only report the status. To remediate the issue, you must use a Configuration Profile to push the correct setting or have the user manually correct it.
How do grace periods work within Intune Compliance Policies?
Grace periods provide users a set amount of time to resolve non-compliance issues before the device is officially marked non-compliant and blocked from accessing resources via Conditional Access.