Day-9: Device Compliance & Configuration Policies (Deep Admin Guide)

Device Compliance & Configuration Policies in Microsoft Intune

---

🎯 Objective of Day-9

By the end of Day-9, you will be able to:

• Explain compliance vs configuration clearly
• Create and assign compliance policies
• Troubleshoot non-compliant devices
• Understand how Conditional Access uses compliance

---

1️⃣ Compliance vs Configuration (MOST IMPORTANT)

Feature	Compliance Policy	Configuration Profile
Purpose	Decide device trust	Apply settings
Result	Compliant / Non-Compliant	Settings enforced
Used by CA	✅ Yes	❌ No
Blocks access	✅ Yes	❌ No

📌 Golden rule:

Compliance = decision
Configuration = enforcement

---

2️⃣ What is a Device Compliance Policy?

A compliance policy checks whether a device:

• Has a password
• Is encrypted
• Is up-to-date
• Is not jailbroken/rooted

If conditions fail → device becomes Non-Compliant

---

3️⃣ Where to Create Compliance Policies

Steps:

1. Intune Admin Center → Devices
2. Device compliance
3. Policies
4. Create policy
5. Choose platform (Windows / iOS / Android)

---

4️⃣ Common Compliance Settings (Windows Example)

Typical checks:

• Require BitLocker
• Require password
• Minimum OS version
• Maximum OS version
• Firewall enabled

📌 These settings do not configure BitLocker — they only check status.

---

5️⃣ Assigning Compliance Policies

Steps:

1. Select compliance policy
2. Assignments
3. Select user or device group
4. Save

⚠ Best practice:
Use user groups, not devices.

---

6️⃣ What Happens When Device Is Non-Compliant?

• Device status = Non-Compliant
• User still signs in (initially)
• Conditional Access evaluates status
• Access may be blocked

📌 Intune itself does not block access — Conditional Access does.

---

7️⃣ Grace Period (Very Important)

Admins can define a grace period.

Example:

• Device becomes non-compliant
• User gets time (e.g. 3 days) to fix it
• After grace → access blocked

📌 Prevents sudden user outages.

---

8️⃣ What is a Configuration Profile?

A configuration profile:

• Enforces settings
• Changes device behavior

Examples:

• Enforce BitLocker
• Password complexity
• Disable USB storage
• Wi-Fi profiles

---

9️⃣ Create Configuration Profile (Windows)

Steps:

1. Intune → Devices
2. Configuration profiles
3. Create profile
4. Platform: Windows 10 and later
5. Profile type: Settings catalog

---

🔟 Compliance Without Configuration (Common Mistake)

Scenario:

• Compliance policy requires BitLocker
• No configuration profile to enable BitLocker

Result:
❌ Device becomes non-compliant
❌ User blocked
❌ Admin escalation

📌 Always pair configuration first, then compliance.

---

1️⃣1️⃣ Monitoring Compliance Status

Steps:

1. Intune → Devices
2. All devices
3. Select device
4. Device compliance

You can see:

• Compliance state
• Failed rules
• Last check-in time

---

1️⃣2️⃣ Troubleshooting Non-Compliant Devices

Checklist:

• License assigned?
• Correct policy assigned?
• OS supported?
• Device synced recently?
• Grace period expired?

📌 90% issues = assignment or licensing.

---

1️⃣3️⃣ Real-World Admin Insight

Never deploy:
❌ Compliance + Conditional Access together on Day-1

Always:
✔ Configure → Monitor → Enforce → Block

---

✅ End of Day-9 Outcome

You can now:
✔ Design compliance policies safely
✔ Explain Intune trust logic
✔ Avoid user lockouts
✔ Prepare for Conditional Access

---

🔜 Day-10 Preview

Day-10: Conditional Access + Intune

• How CA evaluates identity & device
• “Require compliant device” explained
• Common CA mistakes
• Real incident scenarios