INTUNE-002: Device compliance status overview

Platform
Entra ID / M365
Category
Intune / Endpoint Management
Severity
High
Zero Trust pillar
Devices (weight 3)
Golden fixtures
3
Branch coverage
Observed: fixtures prove the verdicts they exercise
Provenance
baseline

What it checks

The overall device compliance status indicates whether enrolled devices meet their assigned compliance policy requirements. A high percentage of non-compliant or not-evaluated devices signals enforcement gaps that could allow insecure devices to access corporate resources. Continuous monitoring of compliance status is essential for maintaining the security posture of the device fleet.

Recommended value

95% or higher device compliance rate across all enrolled devices

Remediation

Review the device compliance overview dashboard to identify the distribution of compliant, non-compliant, and not-evaluated devices. Investigate devices in a not-evaluated state to determine if they lack assigned policies or have sync issues preventing evaluation. Set up compliance status notifications and integrate with Conditional Access to block non-compliant devices from accessing corporate resources.

Fixture-proven verdicts

Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.

Verdict scenarios for INTUNE-002
ScenarioExpected verdict
cleanPASS
known-badFAIL
throttledNot Assessed

Framework mappings

NIST SP 800-53
CM-6