MICROSOFT
Intune device compliance without locking people out
5 min read
Device compliance policies should be measured in report-only mode before they are enforced, because the gap between the devices you think are enrolled and the devices actually in scope is almost always larger than expected.
Device compliance is one of the few security controls that is genuinely simple to describe and routinely painful to deploy. The policy says a device must be encrypted, patched and running a supported OS before it reaches company data. Nobody argues with that.
The pain comes from the devices you did not know about. The laptop that was never enrolled. The phone running a version two releases behind because the user ignored the prompt. The contractor's machine that has been reaching SharePoint for a year.
Turn enforcement on and those people stop working at the same moment. The policy gets rolled back, the project loses credibility, and the next attempt is harder. Staging prevents that.
Measure before you enforce
Create the compliance policy, assign it, and leave the Conditional Access policy that consumes it in report-only mode. The device compliance state populates, Conditional Access logs what it would have done, and nobody is blocked.
Run it for a fortnight. The report tells you exactly how many sign-ins would have been blocked, from which devices, belonging to whom. That number is the real scope of the project, and it is usually not the number in the plan.
Fix the population before you tighten the rule
The report-only data normally splits into three groups, and each needs a different response.
- Enrolled and compliant — no action, these are the devices the policy was written for
- Enrolled but failing a check — usually encryption or OS version, fixable with an update ring and a deadline
- Not enrolled at all — the real work, and the group that decides the project timeline
Grace periods are part of the design
A compliance policy can mark a device non-compliant immediately or after a grace period. Immediate marking is correct for a check the user cannot fix, such as a jailbroken device. A grace period is correct for anything the user can resolve themselves, such as a pending update.
Without a grace period, a device that falls out of compliance at the moment a patch is released blocks its owner before they have had any chance to act. With one, they get a notification and a window. The security outcome is the same and the support queue is very different.
Keep a way back in
Any policy that can block access needs an exclusion that cannot itself be blocked. That means at least one break-glass account, excluded from the Conditional Access policies, with a long complex password stored outside the systems it protects, and alerting on its use.
It is a small thing that takes ten minutes and it is the difference between a misconfigured policy being an inconvenience and being an outage you cannot sign in to fix.
Roll out in rings
Enforce for IT first. Then a pilot group that includes at least one person who travels and one who works from a device you do not fully control, because those two find the problems a head-office pilot never will.
Then department by department, with the report-only data for that department reviewed before each step. The whole sequence takes longer than switching it on at once, and it is the version that is still running six months later.
Questions we get asked
How long should an Intune compliance rollout take?
For a few hundred devices, two to three months is realistic: a fortnight in report-only, several weeks of enrolment and remediation for the devices that fail, then a ringed enforcement. The enrolment backlog, not the policy work, sets the pace.
How do personal devices fit into device compliance?
Usually through app protection policies rather than full device compliance, so company data is controlled inside the apps without the organisation managing a personal phone. Which approach applies to which group is a decision to make before the rollout, because it changes what people are asked to accept.
What should happen when someone is legitimately blocked?
There should be a defined, fast path: a named route to request a temporary exclusion, a time limit on it, and a record of who approved it. Exclusions that are granted informally and never reviewed are how a policy quietly stops covering the people it was written for.