Mark devices without a compliance policy as not compliant

Description

The Intune tenant-wide compliance setting Mark devices with no compliance policy assigned as is set to Not compliant. A device then has to receive at least one compliance policy and meet it before Intune reports it as compliant to Microsoft Entra ID.

Rationale

Conditional Access policies that require a compliant device rely on the status Intune reports. With the default value (Compliant), a device that falls outside every compliance policy assignment, for example a new platform or a user missing from the target group, is reported as compliant without any check of encryption, OS version or jailbreak status. Secure by default closes that gap.

Impact

Enrolled devices that no compliance policy targets become non compliant and lose access to resources protected by a "require compliant device" policy. Before the change, assign a compliance policy to every platform in use (at least one per platform, targeting all users or all devices) and check the Devices without compliance policy report.

Applies when

Requires: Microsoft Intune

Setting

Audit

1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a Global Reader.
2. Browse to Endpoint security > Device compliance > Compliance policy settings.
3. Check that Mark devices with no compliance policy assigned as is Not compliant.
4. Alternative, read only: with Microsoft Graph PowerShell (Connect-MgGraph -Scopes DeviceManagementConfiguration.Read.All), run Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/v1.0/deviceManagement/settings and read secureByDefault.
5. Fail if the setting is Compliant (secureByDefault is false).

Remediation

1. In the Intune admin center, browse to Devices > Monitor > Devices without compliance policy and assign a compliance policy to every platform that shows up.
2. Browse to Endpoint security > Device compliance > Compliance policy settings.
3. Set Mark devices with no compliance policy assigned as to Not compliant and select Save. Role: Intune Administrator, or a custom Intune role with the Device compliance policies update permission.
4. Graph equivalent: PATCH https://graph.microsoft.com/v1.0/deviceManagement with body {"settings": {"secureByDefault": true}}.

Rollback

Set Mark devices with no compliance policy assigned as back to Compliant.

References

• Device compliance policies in Microsoft Intune Microsoft, vendor-doc, accessed 2026-10-24
• Maester test MT.1054 Maester, tool, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-DEVICE-002 Block Intune enrollment of personally owned devices by default
• related CB-M365-DEVICE-010 Configure an Intune cleanup rule for inactive devices
• related CB-M365-AUTH-020 Require a compliant or hybrid joined device to access resources

People and lifecycle