Compliance Policies & Conditional Access

What is a compliance policy?

Compliance settings by platform

Chen Wei at Meridian Bank creates compliance policies for every platform in use. Each platform has different available settings:

Feature	Windows	iOS/iPadOS	Android	macOS
Minimum OS version	Yes	Yes	Yes	Yes
Password required	Yes	Yes	Yes	Yes
Password complexity	Simple/alphanumeric/complex	Simple/alphanumeric	Numeric/low/medium/high	Simple/alphanumeric
Encryption required	BitLocker	Built-in (always on)	Device encryption	FileVault
Firewall required	Yes	No	No	Yes
Antivirus required	Yes (Defender)	No	No	No
Jailbreak/root detection	No (not applicable)	Yes	Yes	No
TPM required	Yes	No	No	No
Secure Boot required	Yes	No	No	No
Defender threat level	Yes	Yes	Yes	Yes

Actions for non-compliance

When a device fails a compliance check, you don’t have to immediately block it. Intune supports a graduated response:

Action	Timing	What Happens
Mark device non-compliant	Immediately (or after grace period)	Device status changes to non-compliant
Send email notification	After X days	User receives an email explaining what’s wrong and how to fix it
Send push notification	After X days	Notification via Company Portal app
Retire device	After X days	Company data removed from device (nuclear option)

Example: Chen Wei configures: immediately mark non-compliant → Day 1: email user → Day 3: push notification → Day 14: retire device. This gives users time to fix issues before losing access.

💡 Exam tip: compliance policy without conditional access does nothing

A compliance policy on its own only labels a device as compliant or non-compliant. It doesn’t block access to anything.

To enforce compliance, you need a Conditional Access policy in Entra ID that says: “Require device to be marked as compliant.”

The exam may present a scenario where a compliance policy is configured but devices still access resources despite being non-compliant. The fix: add a conditional access policy that requires compliance.

Compliance policy = the rules. Conditional access = the enforcement.

Conditional access for compliance

How it works together

1. Device enrolls in Intune
2. Compliance policy evaluates the device → compliant or non-compliant
3. User tries to access a cloud resource (e.g., Exchange Online)
4. Conditional access checks: “Is this device compliant?”
   • Yes → access granted
   • No → access blocked (user sees a remediation message)

Creating a CA policy that requires compliance

In the Entra admin center → Protection → Conditional Access:

Setting	Configuration
Name	Require compliant device for M365 access
Users	All users (exclude break-glass accounts!)
Cloud apps	Office 365 (covers Exchange, SharePoint, Teams, OneDrive)
Conditions	Device platforms: Windows, iOS, Android, macOS
Grant	Require device to be marked as compliant
Session	Default

ℹ️ Deep dive: compliance + CA for BYOD

For personal devices (Entra Registered/BYOD), the compliance check works differently:

• If the device is enrolled in Intune → compliance policy evaluates normally
• If the device is not enrolled → Intune can’t evaluate compliance, so the device is treated as non-compliant by default
• This means: CA requiring compliance effectively forces enrollment for BYOD users who need access to M365 resources

Alternatively, you can use a CA policy that requires app protection policy instead of device compliance. This allows BYOD access through protected apps (Outlook, Teams, OneDrive) without requiring full device enrollment. This is Riko’s approach at Pixel and Co — creative designers with personal Macs don’t want full MDM on their devices.

Compliance policy settings in practice

Chen Wei’s Meridian Bank compliance policy (Windows)

Setting	Value	Why
Minimum OS version	Windows 11 23H2	Banking regulator requires recent OS
BitLocker required	Yes	Encrypt all corporate data at rest
Firewall required	Yes	Network protection
Antivirus required	Yes	Defender must be active
TPM required	Yes	Hardware root of trust
Password minimum length	12 characters	Banking security standard
Defender threat level	Medium or below	Block high-risk devices
Grace period	3 days	Give users time to update

Aroha’s CloudForge compliance policy (Windows)

Setting	Value	Why
Minimum OS version	Windows 11 22H2	Reasonable baseline for startup
BitLocker required	Yes	Protect customer data
Password required	Yes (6+ characters)	Basic security
Grace period	7 days	Startup can be more flexible

Key exam concept: Compliance policies should match the organisation’s risk profile. A bank has stricter settings than a startup, but both need compliance + conditional access to enforce Zero Trust.

🎬 Video walkthrough

Flashcards

Question

What does a compliance policy do on its own (without conditional access)?

Click or press Enter to reveal answer

Answer

It only LABELS a device as compliant or non-compliant. It doesn't block access to anything. You need a conditional access policy that requires compliance to actually enforce access restrictions.

Click to flip back

Show hint

Question

What are the four actions for non-compliance in Intune?

Click or press Enter to reveal answer

Answer

1. Mark device non-compliant (immediately or after grace period) 2. Send email notification 3. Send push notification 4. Retire device (remove company data). These can be scheduled at different time intervals.

Click to flip back

Question

Which platforms support jailbreak/root detection in Intune compliance policies?

Click or press Enter to reveal answer

Answer

iOS/iPadOS (jailbreak detection) and Android (root detection). Windows and macOS do not have jailbreak/root detection as they use different security mechanisms (TPM, Secure Boot, BitLocker, FileVault).

Click to flip back

Knowledge Check

Knowledge Check

Chen Wei creates a compliance policy requiring BitLocker encryption on all Windows devices. Two weeks later, he discovers that some devices without BitLocker are still accessing Exchange Online. What's the most likely cause?

AThe compliance policy has a syntax errorBBitLocker compliance can only be checked on Entra Joined devicesCThere's no conditional access policy requiring device compliance for Exchange OnlineDCompliance policies take 30 days to evaluate

Check Answer

Knowledge Check

Riko at Pixel & Co needs designers with personal Macs to access Outlook and Teams without enrolling their devices in Intune. Which conditional access approach should Riko use?

ARequire app protection policy — this allows access through protected apps without full enrollmentBRequire device to be marked as compliant — this works for all devicesCRequire Entra Hybrid Join — personal Macs can hybrid joinDDon't use conditional access — let all devices access everything

Check Answer

Knowledge Check

Chen Wei's compliance policy for iOS devices at Meridian Bank marks a device non-compliant on Day 0, emails the user on Day 1, sends a push notification on Day 3, and retires the device on Day 14. A user's iPhone is running an old iOS version. What happens on Day 5 if the user hasn't updated?

AThe device is non-compliant, the user has received an email and push notification, but still has 9 more days before retirementBThe device is already retiredCNothing — compliance evaluation hasn't started yetDThe device is blocked from all resources immediately on Day 0

Check Answer

---

Next up: Windows LAPS & Local Group Management — securing local admin accounts and managing local group membership via Intune.