A strong password and MFA protect who is signing in. Device compliance protects what they are signing in from. It checks that a laptop or phone meets your security standards before it can reach company data. This guide explains how device compliance works in Microsoft 365 and how to put it into practice.
What is device compliance?
Device compliance is a set of rules, defined in Microsoft Intune, that a device must meet to be considered healthy. Examples include having disk encryption on, a current operating system version, a password or PIN, antivirus running and no signs of jailbreaking or rooting. Each device is evaluated and marked compliant or non-compliant.
Why it matters for your business
- Stolen credentials are far less useful if the attacker’s device is not trusted.
- Unpatched or unprotected devices are a common route for malware.
- Lost devices holding company data are less of a risk when encryption and PINs are required.
- It helps meet security frameworks, including the Essential Eight, and customer expectations.
How device compliance works in Microsoft 365
- Enrol devices. Company laptops and phones are enrolled in Intune, often automatically with Windows Autopilot for new devices.
- Create compliance policies. Define the standards for each platform, such as Windows, macOS, iOS and Android.
- Evaluate devices. Intune checks each device regularly and records its status.
- Enforce with Conditional Access. A Conditional Access policy can require a compliant device for access to Microsoft 365 and other apps.
- Remediate. Non-compliant users see clear instructions on how to fix the problem, for example installing an update, and regain access once they do.
Building confidence through compliance
The best results come from starting small and adding controls in stages. Begin by reporting on compliance without blocking anyone, fix the common problems, then switch on enforcement for key apps. Give staff plenty of notice and a simple way to get help.
Benefits for your team
- Secure access from anywhere, on trusted devices.
- Fewer security incidents caused by out-of-date machines.
- Clear, automated reporting on the state of every device.
- Less time spent chasing updates by hand.
Device compliance in action
Imagine a staff member whose laptop has missed an important security update. With compliance enforced, they are told what to do, install the update, and carry on. Meanwhile, an attacker using a stolen password on an unknown device is blocked outright.
Best practices
- Require encryption, a screen lock, a supported operating system and active protection.
- Allow a short grace period before blocking access.
- Treat personal and company devices differently, using app protection policies for personal phones.
- Review compliance reports regularly.
Key takeaways
- Device compliance checks that a laptop or phone meets your security standards before it can reach company data.
- Rules are defined in Intune and cover items such as disk encryption, a current operating system, a PIN or password and antivirus.
- Conditional Access enforces the rules by requiring a compliant device.
Device compliance: frequently asked questions
What is device compliance in Microsoft 365?
It is a set of rules, defined in Microsoft Intune, that a device must meet to be considered healthy, such as disk encryption, a current operating system version, a password or PIN, and antivirus running. Each device is evaluated and marked compliant or non-compliant.
How do Intune and Conditional Access work together?
Devices are enrolled in Intune, compliance policies define the standards for each platform, Intune evaluates each device regularly, and a Conditional Access policy can then require a compliant device before granting access to company data.
Why does device compliance matter?
Stolen credentials are far less useful on an untrusted device, unpatched devices are a common route for malware, lost devices holding company data are less of a risk when encryption and PINs are required, and it helps meet frameworks such as the Essential Eight.
Related reading: Microsoft Intune consulting. For Microsoft or government guidance, see Microsoft guidance on device compliance.
Total Solutions IT designs and manages Intune device compliance for Australian businesses. Call 02 6061 4222 to find out more.
