INTUNE-003: Non-compliant device enumeration
- Platform
- Entra ID / M365
- Category
- Intune / Endpoint Management
- Severity
- High
- Zero Trust pillar
- Devices (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Devices that fail compliance policy evaluation pose a direct risk to the organization by potentially lacking encryption, running outdated operating systems, or having disabled security features. Enumerating non-compliant devices and understanding the specific compliance failures enables targeted remediation. Without this visibility, insecure devices may continue accessing corporate data undetected.
Recommended value
Zero non-compliant devices with access to corporate resources; all non-compliant devices should be blocked or in remediation
Remediation
Generate a detailed report of non-compliant devices including the specific compliance settings that are failing for each device. Prioritize remediation of devices failing critical compliance checks such as encryption or antivirus requirements, and work with device owners to resolve issues. Configure actions for non-compliance in each compliance policy to mark devices as non-compliant after a grace period and integrate with Conditional Access to restrict resource access.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | FAIL |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-6