Intune Compliance Policies that Make Sense

Introduction

In today's dynamic IT landscape, device management extends beyond simply provisioning hardware. Ensuring that endpoints accessing organizational resources adhere to predefined security standards is paramount. This is precisely where Microsoft Intune compliance policies come into play. These policies define the conditions a device must meet to be considered "compliant" within your organization's security framework.

This article is designed for IT administrators, security engineers, and architects responsible for managing Windows endpoints within an enterprise environment. We will explore how to effectively design, implement, and manage Intune compliance policies for Windows devices, moving beyond basic configurations to demonstrate strategies that truly enhance your security posture while supporting user productivity.

Why this matters

The implementation of robust Intune compliance policies carries significant business and technical advantages. Firstly, it directly addresses regulatory compliance requirements (e.g., GDPR, HIPAA, PCI DSS) by enforcing security baselines on devices that handle sensitive data, thereby reducing legal and financial risks associated with non-compliance. Secondly, it strengthens your overall security posture by mitigating common attack vectors. Non-compliant devices, such as those lacking up-to-date antivirus or a secure boot, are high-risk entry points for malware and unauthorized access.

Moreover, these policies play a crucial role in enabling a Zero Trust security model, where every access request is explicitly verified, regardless of its origin. By ensuring device compliance, you add a critical layer of trust to your access decisions. This not only reduces the risk of data breaches but can also indirectly lead to cost savings by minimizing the resources spent on incident response and remediation from compromised devices. Finally, by automating compliance checks, IT teams can focus on strategic initiatives rather than manual device auditing, thereby improving operational efficiency and productivity.

Key concepts

• Intune: Microsoft Intune is a cloud-based service in the Enterprise Mobility + Security (EMS) suite that focuses on mobile device management (MDM) and mobile application management (MAM). It allows organizations to manage users' devices and applications, including Windows, macOS, Android, and iOS.
• Compliance Policy: A set of rules and settings that a device must meet to be considered compliant by an organization. These policies are assigned to user groups or device groups.
• Non-compliance Actions: Configurable actions that Intune takes when a device is determined to be non-compliant. These can range from sending notifications to blocking access to corporate resources.
• Conditional Access: A feature in Microsoft Entra ID that allows organizations to enforce policies based on various conditions, including device compliance status. It acts as a gatekeeper, granting or denying access to resources.
• Security Baselines: Pre-configured sets of Windows settings recommended by Microsoft for security. While not directly compliance policies, adherence to baselines often informs and influences compliance policy settings.
• Remediation: For some compliance settings (e.g., password complexity), Intune can automatically attempt to remediate non-compliant devices. Many settings, however, require user action or IT intervention.

Step-by-step implementation

Implementing effective Intune compliance policies involves a structured approach.

1. Define Compliance Requirements: Before configuring policies, clearly define what "compliant" means for your organization. This should align with security policies, regulatory needs, and business risks.
2. Navigate to Intune:

Go to the [Microsoft Intune admin center](https://intune.microsoft.com). Navigate to Devices > Compliance policies.

1. Create a New Policy:

Click Create policy. For Platform, select Windows 10 and later. Click Create. On the Basics tab, provide a descriptive Name (e.g., "Windows 10/11 Corporate Compliance") and an optional Description*.

1. Configure Compliance Settings:

On the Compliance settings tab, configure the desired security requirements. Device Health: Require Secure Boot to be enabled: Require Require Code Integrity: Require Device Properties: Minimum OS version: 10.0.19045 (Windows 10 22H2 / Windows 11 21H2) Maximum OS version: (leave blank for latest) System Security: Require a password to unlock mobile devices: Require Password type: Alphanumeric Minimum password length: `8` Number of non-alphanumeric characters in password: 2 Password expiration (days): `90` Prevent reuse of previous passwords: 5 Require encryption of data storage on device: Require Require Anti-malware: Require Require Windows Defender Exploit Guard: Require Windows Defender Antimalware minimum version: 4.18.23070.1000 (example) Windows Defender Antimalware security intelligence up-to-date: Require Firewall: Require Click Next*.

1. Configure Actions for Noncompliance:

On the Actions for noncompliance tab, define what happens when a device is non-compliant. Mark device noncompliant (Default): This action immediately marks the device as non-compliant. Send email to end-user: Configure a notification template to inform users. Remotely lock the noncompliant device: After a specified number of days. Retire the noncompliant device: After a specified number of days. Add a suitable action, e.g., "Send email to end-user" after 0 days. Select a built-in message template or create a custom one. Click Next*.

1. Assign the Policy:

On the Assignments tab, select the Entra ID user or device groups to which this policy applies. For corporate devices, assigning to device groups can be more efficient. Choose Add groups and search for your target group (e.g., "All Corporate Windows Devices"). Click Next*.

1. Review and Create:

On the Review + create tab, verify all settings. Click Create.

To further enhance automation and reporting, you can interact with Intune compliance policies using Microsoft Graph PowerShell. For example, to retrieve all compliance policies:

# Ensure you have the Microsoft.Graph.Intune module installed:
# Install-Module -Name Microsoft.Graph.Intune

Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"

$compliancePolicies = Get-MgDeviceManagementDeviceCompliancePolicy
$compliancePolicies | Select-Object DisplayName, Platform, CreatedDateTime, @{Name="SettingCount"; Expression={$_.Settings.Count}} | Format-Table

Example configuration

Here's an example of a compliance policy structure in JSON format, often used when working with Graph API or automating deployments. This snippet focuses on a few key Windows device health and security settings.

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "displayName": "ZT-Win-Corporate-Compliance-Policy",
  "description": "Zero Trust compliance policy for corporate Windows 10/11 devices.",
  "scheduledActionsForRule": [
    {
      "ruleName": "Mark device as noncompliant",
      "scheduledActionConfigurations": [
        {
          "actionType": "markAsNoncompliant",
          "gracePeriodHours": 0,
          "notificationTemplateId": null # Default action
        },
        {
          "actionType": "sendPushNotification",
          "gracePeriodHours": 0,
          "notificationTemplateId": "your-email-notification-template-guid" # Replace with your template GUID
        }
      ]
    }
  ],
  "osMinimumVersion": "10.0.19045",
  "osMaximumVersion": null,
  "secureBootRequired": true,
  "codeIntegrityEnabled": true,
  "deviceEncryptionEnabled": true,
  "passwordRequired": true,
  "passwordType": "alphanumeric",
  "passwordMinimumLength": 8,
  "passwordRequiredToUnlockAfterIdleTimeout": true,
  "passwordExpirationDays": 90,
  "passwordPreviousPasswordBlockCount": 5,
  "firewallEnabled": true,
  "antiMalwareEnabled": true,
  "defenderExploitProtectionRequired": true,
  "defenderSecurityCenterRequired": true,
  "defenderVersion": "4.18.23070.1000",
  "defenderSecurityIntelligenceUpdateStatus": "upToDate"
}

Common pitfalls

• Overly Aggressive Policies from Day One: Implementing too many strict policies immediately can lead to a flood of non-compliant devices, user frustration, and excessive helpdesk calls. Start with a baseline, monitor, and iterate.
• Lack of Communication: Failing to inform users about compliance requirements and the consequences of non-compliance can lead to confusion and resistance.
• Inadequate Testing: Deploying policies without thorough testing on a pilot group can cause unexpected issues or block legitimate workflows for a broad user base.
• Forgetting Non-compliance Actions: A compliance policy without defined actions for non-compliance is largely ineffective, as it won't enforce remediation or restrict access.
• Ignoring User Experience: Placing excessive burdens on users (e.g., very short password expiration, complex password requirements without adequate training) can lead to workarounds that undermine security.
• No Conditional Access Integration: While compliance policies define compliance, Conditional Access is what enforces access restrictions based on that status. Without Conditional Access, a non-compliant device might still access resources.

Best practices

• Phased Rollout: Following the Microsoft Cloud Adoption Framework's guidance on iterative deployment, implement compliance policies in phases. Start with a small pilot group, expand to a larger test group, and then gradually deploy to the entire organization.
• Integrate with Conditional Access: Always pair Intune compliance policies with Conditional Access policies. Use the compliance status as a condition for granting access to Microsoft 365 services and other enterprise applications. This embodies a core tenet of Zero Trust: verify explicitly.
• Define Clear User Notifications: Configure clear, actionable, and informative email notifications for non-compliant users. Direct them to self-remediation steps or IT support resources.
• Monitor and Report Regularly: Utilize Intune's reporting capabilities to continuously monitor the compliance status of your devices. Identify trends, common compliance issues, and address them proactively. Consider exporting data to Azure Log Analytics for advanced analytics.
• Keep Policies Up-to-Date: Operating system versions, security threats, and organizational requirements evolve. Regularly review and update your compliance policies to ensure they remain relevant and effective. Align policy updates with the Well-Architected Framework's principle of operational excellence.
• Leverage Microsoft Security Baselines: While not a compliance policy directly, using Intune Security Baselines as a foundation for configuration settings can guide the initial setup of your compliance requirements, ensuring alignment with Microsoft's recommended security postures.

Further reading

• Create a compliance policy in Microsoft Intune
• Monitor compliance policies in Microsoft Intune
• Conditional Access: Require compliant device
• Zero Trust guidance center
• Well-Architected Framework