{
  "id": "CB-M365-DEVICE-001",
  "standard": "m365",
  "version": "main",
  "url": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-001",
  "json": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-001.json",
  "yaml": "https://baselines.cirsec.org/b/m365/CB-M365-DEVICE-001.yml",
  "profiles_effective": [
    "baseline",
    "hardened"
  ],
  "license": "Text CC BY 4.0, code Apache-2.0",
  "attribution": "CIRSEC Baselines, https://baselines.cirsec.org",
  "control": {
    "id": "CB-M365-DEVICE-001",
    "title": "Mark devices without a compliance policy as not compliant",
    "finding": {
      "title": "Intune treats devices without a compliance policy as compliant",
      "description": "Any enrolled device that no compliance policy targets passes the \"require compliant device\" Conditional Access check without being evaluated."
    },
    "status": "active",
    "profiles": [
      "baseline"
    ],
    "risk": {
      "severity": "medium"
    },
    "assessment": "manual",
    "tags": [
      "intune",
      "device-compliance",
      "conditional-access",
      "secure-by-default"
    ],
    "applicability": {
      "requires": [
        "Microsoft Intune"
      ]
    },
    "description": "The Intune tenant-wide compliance setting **Mark devices with no compliance policy assigned as**\nis set to **Not compliant**. A device then has to receive at least one compliance policy and meet\nit before Intune reports it as compliant to Microsoft Entra ID.\n",
    "rationale": "Conditional Access policies that require a compliant device rely on the status Intune reports.\nWith the default value (**Compliant**), a device that falls outside every compliance policy\nassignment, for example a new platform or a user missing from the target group, is reported as\ncompliant without any check of encryption, OS version or jailbreak status. Secure by default\ncloses that gap.\n",
    "impact": "Enrolled devices that no compliance policy targets become non compliant and lose access to\nresources protected by a \"require compliant device\" policy. Before the change, assign a\ncompliance policy to every platform in use (at least one per platform, targeting all users or\nall devices) and check the **Devices without compliance policy** report.\n",
    "setting": {
      "location": "Intune admin center > Endpoint security > Device compliance > Compliance policy settings > Mark devices with no compliance policy assigned as",
      "default_value": "Compliant",
      "recommended_value": "Not compliant"
    },
    "audit": {
      "manual": "1. Sign in to the Microsoft Intune admin center (https://intune.microsoft.com) as at least a\n   Global Reader.\n2. Browse to **Endpoint security** > **Device compliance** > **Compliance policy settings**.\n3. Check that **Mark devices with no compliance policy assigned as** is **Not compliant**.\n4. Alternative, read only: with Microsoft Graph PowerShell\n   (`Connect-MgGraph -Scopes DeviceManagementConfiguration.Read.All`), run\n   `Invoke-MgGraphRequest -Method GET -Uri https://graph.microsoft.com/v1.0/deviceManagement/settings`\n   and read `secureByDefault`.\n5. Fail if the setting is **Compliant** (`secureByDefault` is `false`).\n"
    },
    "remediation": {
      "manual": "1. In the Intune admin center, browse to **Devices** > **Monitor** > **Devices without\n   compliance policy** and assign a compliance policy to every platform that shows up.\n2. Browse to **Endpoint security** > **Device compliance** > **Compliance policy settings**.\n3. Set **Mark devices with no compliance policy assigned as** to **Not compliant** and select\n   **Save**. Role: Intune Administrator, or a custom Intune role with the\n   **Device compliance policies** update permission.\n4. Graph equivalent: `PATCH https://graph.microsoft.com/v1.0/deviceManagement` with body\n   `{\"settings\": {\"secureByDefault\": true}}`.\n",
      "rollback": "Set **Mark devices with no compliance policy assigned as** back to **Compliant**.\n"
    },
    "references": [
      {
        "title": "Device compliance policies in Microsoft Intune",
        "url": "https://learn.microsoft.com/intune/device-security/compliance/overview",
        "publisher": "Microsoft",
        "kind": "vendor-doc",
        "accessed": "2026-10-24"
      },
      {
        "title": "Maester test MT.1054",
        "url": "https://maester.dev/docs/tests/MT.1054",
        "publisher": "Maester",
        "kind": "tool",
        "accessed": "2026-10-24"
      }
    ],
    "mappings": [
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "AC-19",
        "relation": "related"
      },
      {
        "framework": "nist-800-53r5",
        "framework_version": "5.1.1",
        "id": "CM-6",
        "relation": "related"
      }
    ],
    "threats": [
      {
        "framework": "mitre-attack",
        "id": "T1078.004"
      }
    ],
    "related_controls": [
      {
        "id": "CB-M365-DEVICE-002",
        "type": "related"
      },
      {
        "id": "CB-M365-DEVICE-010",
        "type": "related"
      },
      {
        "id": "CB-M365-AUTH-020",
        "type": "related"
      }
    ],
    "authors": [
      {
        "name": "Alice",
        "github": "Sn0wAlice"
      }
    ],
    "introduced_in": "0.1.0",
    "created": "2026-10-24",
    "updated": "2026-10-24"
  }
}