2.1MD-102Intermediate
Est: ~15 mins•Verified: 2026-08

Intune Device Compliance Policies: Windows 10 & 11

Configure device compliance baselines (BitLocker, Secure Boot, Antivirus, minimum OS builds), evaluate device health, and enforce Zero-Trust access with Conditional Access.

Tags:#Compliance#BitLocker#Conditional Access#Secure Boot#Defender#MD-102
01

Overview

Device Compliance Policies in Microsoft Intune establish security baselines that Windows 10/11 endpoints must satisfy before receiving access to organizational resources (Email, SharePoint, Teams, and internal SaaS apps).

When integrated with Microsoft Entra Conditional Access, non-compliant devices are automatically blocked from accessing corporate data until all security discrepancies are remediated.

---

02

When to Use

ScenarioRecommendationTechnical Rationale
Block Unencrypted LaptopsMandatoryEnforce BitLocker compliance to prevent data leakage from lost or stolen devices.
Enforce Minimum OS VersionRecommendedProtect against known vulnerabilities (CVEs) by mandating current security patch levels.
Verify Boot IntegrityRecommendedRequire Secure Boot and Code Integrity to block kernel rootkits prior to OS initialization.

---

03

Prerequisites

  • Licensing: Microsoft Intune Plan 1 + Microsoft Entra ID P1 or P2.
  • Admin Role: Intune Administrator or Endpoint Security Manager.
  • Device State: Enrolled in Intune (Entra Joined or Hybrid Entra Joined).

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Compliance
        └── Policies
            └── Create Policy (Windows 10 and later)

---

05

Step-by-Step Implementation

Step 1: Create the Compliance Policy

  1. Navigate to Devices > Compliance > Policies > Create policy.
  2. Platform: Windows 10 and later | Profile type: Windows 10/11 compliance policy.

Step 2: Configure Compliance Settings

  • Device Health:
  • Require BitLocker: Require
  • Require Secure Boot: Require
  • Require Code Integrity: Require
  • Device Properties:
  • Minimum OS version: 10.0.22631 (Windows 11 23H2 baseline)
  • System Security:
  • Firewall: Require
  • Antivirus: Require
  • Antispyware: Require

Step 3: Actions for Noncompliance

  • Immediately: Mark device noncompliant
  • After 1 day: Send email to end user with remediation guidance
  • After 30 days: Retire the noncompliant device

---

06

PowerShell Commands

Check Compliance Settings Locally on Endpoint:

PowerShell
# Verify BitLocker volume status
Get-BitLockerVolume -MountPoint "C:" | Select-Object MountPoint, VolumeStatus, EncryptionPercentage, ProtectionStatus

# Verify Windows Defender real-time protection
Get-MpComputerStatus | Select-Object AMServiceEnabled, AntivirusEnabled, RealTimeProtectionEnabled

# Verify Firewall profiles
Get-NetFirewallProfile | Select-Object Name, Enabled

Query Non-Compliant Devices via Microsoft Graph PowerShell SDK:

PowerShell
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All"

# List all non-compliant devices with operating system details
Get-MgDeviceManagementManagedDevice -Filter "complianceState eq 'noncompliant'" | 
    Select-Object deviceName, userPrincipalName, operatingSystem, osVersion, complianceState | 
    Format-Table -AutoSize

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/4 (0%)
Policy status shows Active and assigned to target user groups.
On endpoint, initiate an Intune Sync via Company Portal app: Device displays In Compliance.
BitLocker recovery keys successfully escrowed to Entra ID.
Deliberately disabling Windows Firewall triggers Non-compliant status within next evaluation cycle.
10

Troubleshooting Matrix

Error / StateRoot CauseExact Resolution
Not EvaluatedDevice is freshly enrolled and has not yet executed its first complete policy sync.On device, open Settings > Accounts > Access work or school > Click Info > Click Sync.
BitLocker: Error 65000TPM 2.0 is missing/disabled, or legacy Group Policy conflicts with Intune CSP.Verify TPM is enabled in UEFI BIOS and review Event Viewer > Applications > Microsoft > Windows > BitLocker-API.
Policy ConflictMultiple compliance policies assigned with conflicting settings.Review device compliance details. Intune applies the Most Restrictive Setting rule.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Essential Exam Concepts:

  1. Detection vs Enforcement: Compliance policies do not configure settings (e.g., they do not turn on BitLocker); they only evaluate whether the setting is already active. To enforce settings, use Configuration Profiles.
  2. Grace Period: Organizations can grant a grace period before a device is marked non-compliant, allowing users time to remediate issues.
  3. Default Noncompliance Action: The default immediate action is always Mark device noncompliant: Immediately.
PREVIOUS TOPIC1.5 Mobile Enrollment: Apple ADE & Android EnterpriseNEXT TOPIC2.2 Conditional Access: Require Compliant Device