Compliance matters more than most Intune settings, because Conditional Access acts on it. A device that should be compliant but isn't gets blocked from email and Teams. A device that shows compliant without really being evaluated is a security gap. Both come from the same short list of causes.
How compliance status works
When a device checks in, Intune evaluates every compliance policy assigned to it, plus the tenant-wide compliance policy settings, and writes a single state to the device's Entra ID object:
- Compliant: passes every assigned policy
- Not compliant: fails at least one setting, and the grace period is over
- In grace period: failing, but not yet marked non-compliant
- Not evaluated: no policy has reported yet
Conditional Access reads that final state from Entra ID, not from Intune directly, which is why the two can briefly disagree.
1. The device hasn't checked in
Check Intune -> Devices -> [device] -> Overview -> Last check-in. If it's hours old, sync the device and allow 10–15 minutes before rechecking.
# On the device: trigger the Intune sync tasks
Get-ScheduledTask -TaskPath "\Microsoft\Windows\EnterpriseMgmt\*" |
Where-Object TaskName -like "*Schedule #3*" | Start-ScheduledTaskYou can also sync from Intune (Devices -> [device] -> Sync), or on the device under Settings -> Accounts -> Access work or school -> Info -> Sync.
2. The policy isn't targeting the device
Open Devices -> [device] -> Device compliance. It lists every compliance policy targeting the device and its per-policy state. If your policy isn't listed:
- Check whether it's assigned to a user group or a device group, and that the device (or its primary user) is actually a member.
- Check for an exclusion group or an assignment filter that catches the device.
Connect-MgGraph -Scopes "Device.Read.All","GroupMember.Read.All"
$d = Get-MgDevice -Filter "displayName eq 'LAPTOP-042'"
Get-MgDeviceMemberOf -DeviceId $d.Id | ForEach-Object { $_.AdditionalProperties.displayName }3. No policy assigned, and the default says "Compliant"
In Endpoint security -> Device compliance -> Compliance policy settings, the setting Mark devices with no compliance policy assigned as decides what happens to devices outside every policy. If it's set to Compliant, those devices pass Conditional Access without being checked at all. Set it to Not compliant once your policies cover every platform you allow.
4. The grace period hides the real status
Each policy's Actions for noncompliance has a schedule for "Mark device noncompliant." If it's set to several days, a failing device shows In grace period and Conditional Access still lets it through. That's by design, but make sure the delay is intentional.
5. A specific setting is failing
In the per-policy view, click into the failing policy to see each setting's required value vs. actual value. The usual suspects:
- BitLocker / encryption required while the device is still encrypting, or has encryption suspended
- Minimum OS version set above what devices have installed
- Microsoft Defender or device threat level settings, which depend on the Defender connector being set up and healthy
- Secure Boot / Code integrity (Device Health Attestation), which only report after a reboot
6. The enrollment or device object is broken
A device can be Entra-joined without being MDM-enrolled, and then it's never evaluated.
dsregcmd /status | findstr /i "AzureAdJoined MDMUrl"A missing MDMUrl means the device isn't enrolled in Intune. Check the automatic enrollment scope, then re-enroll.
Duplicate device objects cause the same symptoms. If Entra ID shows two objects with the same name, Conditional Access may be reading the stale one. Delete the stale object (after confirming which is which), then sync.
A fleet-wide problem is a design problem
If one device won't go compliant, it's usually one of the causes above. If many devices flip between states, or new devices are blocked on first sign-in, the problem is usually in how compliance, grace periods, and Conditional Access were designed to work together. That's worth fixing properly rather than device by device.