Company Windows laptops reach company data only when they are compliant

Tenant-wide compliance settings

Two settings apply to every device in the tenant. Set them on purpose before the Conditional Access policy is turned on.

1. Mark devices with no compliance policy assigned as

   Intune admin center > Endpoint security > Device compliance > Compliance policy settings

   ValueNot compliant

   WhyThe default is Compliant, so an enrolled laptop that no compliance policy reaches passes the Conditional Access check below without being checked at all. Warning: the setting is tenant-wide. If any Conditional Access policy that requires a compliant device is already On, changing it makes every enrolled device without a compliance policy noncompliant for that policy, and Microsoft's page does not say how soon; treat it as immediate. Check first: in Conditional Access, which policies are On with Require device to be marked as compliant; in Intune, which enrolled devices have no compliance policy assigned (Company Portal shows them "No compliance policies have been assigned"). Assign their policies (the Assignments step) before you change this, or make the change while every such policy is in Report-only (Rolling it out).

   • Conflicts withA Conditional Access policy that requires a compliant device is already On. Every enrolled device with no compliance policy assigned becomes noncompliant for that policy; treat it as immediate. Resolved by Assignments.

   “If you use Conditional Access with your device compliance policies, change this setting to Not compliant to ensure that only devices that are confirmed as compliant can access your resources.”

   “If an end user isn't compliant because a policy isn't assigned to them, the Company Portal app shows No compliance policies have been assigned. … If your Conditional Access policies have Access controls set to Require device to be marked as compliant, Conditional Access uses that compliance status to determine whether to grant or block access to email and other organization resources. If you use device compliance status with Conditional Access policies, review how your tenant configures the Mark devices with no compliance policy assigned as option, which you manage under Compliance policy settings.”

2. Compliance status validity period (days)

   Intune admin center > Endpoint security > Device compliance > Compliance policy settings

   ValueA number of days you choose and write in your baseline (Microsoft's default is 30; 1 to 120 can be set). A shorter period refuses a laptop that has stopped checking in sooner.

   WhyA laptop that stops reporting keeps its last status until this period ends; after that it is treated as noncompliant.

   “If a device fails to report its compliance status for a policy before the validity period expires, the device is treated as noncompliant.”

A compliance policy for Windows (and one for each other platform)

Create the policy in the Intune admin center under Devices > Manage devices > Compliance > Create policy, with Platform set to Windows 10 and later. The settings are the minimum this recipe relies on; add the others your baseline names. Then give every other platform that signs in its own policy.

1. Require BitLocker

   Windows compliance policy > Device health

   ValueRequire

   WhyTies sign-in to an encrypted system drive. The encryption recipe sets BitLocker up; this setting only checks it. Microsoft notes it is measured at boot, so a laptop encrypted today shows compliant after a restart.

   “Require - The device can protect data that's stored on the drive from unauthorized access when the system is off, or hibernates. … If using a device compliance policy in Intune, be aware that the state of this setting is only measured at boot time.”

2. Require Secure Boot to be enabled on the device

   Windows compliance policy > Device health

   ValueRequire

   WhyA laptop that boots tampered startup files is refused. Microsoft states that a device without TPM 2.0 shows as Not Compliant with this setting, so check the fleet in the report-only pilot.

   “Require - The system is forced to boot to a factory trusted state. … For devices that don't support TPM 2.0 or later, the policy status in Intune shows as Not Compliant.”

3. Require code integrity

   Windows compliance policy > Device health

   ValueRequire

   WhyReports an unsigned driver or system file loaded into the kernel as noncompliant.

   “Require - Require code integrity, which detects if an unsigned driver or system file is being loaded into the kernel.”

4. Minimum OS version

   Windows compliance policy > Device properties

   ValueThe oldest Windows build and update you still accept, in major.minor.build.revision form, on a version Microsoft still services: on 2026-11-12, build 26200 (Windows 11 25H2) for Pro, Pro Education and Enterprise, or 26100 (24H2) only for Enterprise and Education. The revision is a real one from Microsoft's Windows 11 release information: for example 10.0.26200.9818 (the 2026-10-28 update) or 10.0.26200.9974 (the 2026-11-10 security update), whichever is the oldest you accept. The prefix: Microsoft's page says to include the version prefix, "like 11.0 for Windows 11", but the same page says to read the value from ver, which returns 10.0, and its own Windows 11 examples (Valid operating system builds) begin 10.0. This recipe uses 10.0, as ver shows it; the Minimum OS version test below (Should be refused) is what confirms the form on your tenant. Raise it as you approve updates.

   WhyA laptop that falls behind on updates is refused until it is updated. The encryption recipe's constraint applies here: no serviced Windows 11 build has modules listed on Microsoft's FIPS 140 page, so this minimum will be a build with no listed certificate. Do not lower it to 22H2 (10.0.22621), the newest version with listed certificates, to match one: Microsoft no longer services it. Record the gap instead (the encryption recipe, Case 1).

   “When a device has an earlier version than the OS version you enter, it's reported as noncompliant. A link with information on how to upgrade is shown. The end user can choose to upgrade their device. After they upgrade, they can access company resources.”

   “Be sure to include the appropriate version prefix before the build numbers, like 11.0 for Windows 11. Minimum OS version: Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver. The ver command returns the version in the following format: Microsoft Windows [Version 10.0.17134.1] … Example: Description Minimum OS version Maximum OS version Windows 11 24H2 (Oct–Dec 2024) 10.0.26100.1742 10.0.26100.2605”

   “Version 25H2 (OS build 26200) Servicing option Update type Availability date Build KB article General Availability Channel 2026-11 B 2026-11-10 26200.9974 KB5132061 General Availability Channel 2026-10 D 2026-10-28 26200.9818 KB5127936”

5. Firewall

   Windows compliance policy > System Security > Device security

   ValueRequire

   WhyA laptop with Windows Firewall off is refused. Microsoft notes that a Group Policy turning the firewall off makes the device Not compliant even if Intune turns it on, so remove conflicting Group Policy first.

   “Require - Turn on the Windows Firewall, and prevent users from turning it off. … If a configuration is applied (for example, via a group policy) to a device that configures Windows Firewall to allow all inbound traffic, or turns off the firewall, setting Firewall to Require will return Not compliant, even if Intune device configuration policy turns Firewall on. This is because the group policy object overrides the Intune policy. To fix this issue, we recommend that you remove any conflicting group policy settings, or that you migrate your Firewall-related group policy settings to Intune device configuration policy.”

6. Microsoft Defender Antimalware

   Windows compliance policy > System Security > Defender

   ValueRequire

   WhyA laptop whose antimalware service is off is refused.

   “Require - Turn on the Microsoft Defender anti-malware service, and prevent users from turning it off.”

7. Microsoft Defender Antimalware security intelligence up-to-date

   Windows compliance policy > System Security > Defender

   ValueRequire

   WhyA laptop with out-of-date malware definitions is refused until they update.

   “Require - Force the Microsoft Defender security intelligence be up-to-date.”

8. Schedule (days after noncompliance)

   Compliance policy > Actions for noncompliance > Mark device noncompliant

   Value0 (immediately), unless you decide on a grace period; write the number of days you choose in your baseline.

   WhyA grace period lets a user fix a problem before losing access; it is also a period in which a noncompliant laptop still gets in. Choose it on purpose.

   “Each compliance policy includes Mark device noncompliant as a built-in default action, scheduled to trigger immediately at zero days. … When you change the default schedule, you provide a grace period in which a user can remediate issues or become compliant without being marked as noncompliant.”

9. Assignments

   Compliance policy > Assignments

   ValueThe Windows policy to a group you make of the people who sign in to company data (or of the company's Windows devices), rather than to the built-in all-users choice, so a test user can be left out for the refused test below; a separate policy for each other platform those people sign in from. Write down which way you assign it (users or devices): the refused test depends on it.

   WhyWith the tenant setting above at Not compliant, a device that no policy reaches is refused. Assigning a policy per platform is what keeps the right devices working; the no-policy refused test shows what happens to a device the assignment misses.

   “Not compliant: This security feature is on. Devices without a device compliance policy are considered noncompliant.”

The Conditional Access policy that requires a compliant device

Microsoft Entra admin center > Entra ID > Conditional Access > Policies > New policy. Microsoft warns that without an Intune compliance policy this policy will not work as intended: create the compliance policies first.

1. Users

   Conditional Access policy > Assignments > Users

   ValueInclude: All users. Exclude: your emergency access accounts only (and, if you synchronise from Active Directory, the Directory Synchronization Accounts role).

   WhyAccounts are checked unless they are excluded, and the exclusions are kept to the emergency accounts, so a mistake in this policy cannot lock every administrator out. The bypass test that lists the exclusions checks it.

   “Verify that emergency access accounts are excluded from any Conditional Access policy that blocks or restricts sign-in.”

   “Under Include, select All users Under Exclude: Select Users and groups Choose your organization's emergency access or break-glass accounts. If you use hybrid identity solutions like Microsoft Entra Connect or Microsoft Entra Connect Cloud Sync, select Directory roles, then select Directory Synchronization Accounts”

2. Resources (formerly cloud apps)

   Conditional Access policy > Target resources

   ValueInclude: All resources

   WhyA policy limited to a few apps leaves the others open to unmanaged devices.

   “Under Target resources > Resources (formerly cloud apps) > Include, select All resources (formerly 'All cloud apps').”

3. Grant

   Conditional Access policy > Access controls > Grant

   ValueRequire device to be marked as compliant

   WhyAccess is granted only to a device Intune reports as compliant.

   “Under Access controls > Grant. Select Require device to be marked as compliant.”

   “Devices must be registered in Microsoft Entra ID before they can be marked as compliant. … The Require device to be marked as compliant control: Only supports Windows 10+, iOS, Android, macOS, and Linux Ubuntu devices registered with Microsoft Entra ID and enrolled with Intune. Microsoft Edge in InPrivate mode on Windows is considered as a noncompliant device.”

4. Device platforms

   Conditional Access policy > Conditions > Device platforms

   ValueNot configured: the policy applies to every platform. Do not narrow it to Windows.

   WhyThe platform is read from the user agent, which the user controls. A policy that covers only Windows lets a browser that claims to be Linux skip it.

   “Because user agent strings can be modified, this information isn't verified. Use device platform with Microsoft Intune device compliance policies or as part of a block statement. By default, it applies to all device platforms.”

5. Enable policy

   Conditional Access policy > Enable policy

   ValueReport-only while you pilot; On only after the report shows no device you mean to keep would be refused.

   WhyReport-only evaluates sign-ins and logs what the policy would have done without refusing anyone.

   ThenOn

   “Confirm your settings and set Enable policy to Report-only. … After confirming your settings using policy impact or report-only mode, move the Enable policy toggle from Report-only to On.”

Should pass

• DoOn a pilot laptop that is enrolled, has the Windows policy and shows Compliant in Company Portal, sign in to Outlook on the web in Microsoft Edge with the work account.

  ExpectAccess is granted, and the sign-in log entry's Conditional Access tab shows this policy applied with its grant control satisfied.

Should be refused

• DoWith the policy On, sign in to the same account from a personal laptop that is not enrolled, in any browser.

  ExpectRefused by this policy (the sign-in log entry's Conditional Access tab, not Report-only, shows it as the reason).

• ChangesLeaves the test user, or the test laptop, out of the Windows compliance policy's assignment, so the laptop has no compliance policy and is Not compliant until it is put back.

  BeforeUse the test laptop and test user (Before you start), never a person's working laptop. Check how the Windows policy is assigned (Assignments: you wrote down users or devices). If it is assigned to a group of users, the test user must be in no group the Windows policy is assigned to and must be the one who enrolled and signs in on the test laptop; if it is assigned to a group of devices, the test laptop must be in no group it is assigned to. Note the groups the test user and the test laptop are in now.

  DoWith the test user (policy assigned to users) or the test laptop (policy assigned to devices) out of every group the Windows compliance policy is assigned to, so that no Windows compliance policy is assigned to the laptop, sync the laptop and open Company Portal before you sign in. Then sign in to Outlook on the web as the test user.

  AfterwardsPut the test user or the test laptop back in the groups you noted, sync the laptop, and check that Company Portal shows the Windows policy and Compliant, and that the next sign-in is granted.

  ExpectBefore the sign-in, Company Portal shows "No compliance policies have been assigned" (Microsoft's wording for a user no policy reaches); if it lists the Windows policy, the policy still reaches the laptop and the test has not started. The sign-in is refused and the device is Not compliant in Intune.

  “If an end user isn't compliant because a policy isn't assigned to them, the Company Portal app shows No compliance policies have been assigned.”

• ChangesTurns off the test laptop's Windows Firewall, so the laptop is Not compliant until it is turned back on.

  BeforeUse the test laptop you can break on purpose (Before you start), on its normal Windows policy, showing Compliant.

  DoOn the test laptop, turn Windows Firewall off, sync, and sign in.

  AfterwardsThe second Recovery test below: turn the firewall back on and sync, and the laptop shows Compliant again and the next sign-in is granted.

  ExpectThe laptop shows Not compliant with Firewall named as the failing setting, and the sign-in is refused.

• ChangesAssigns the test laptop a second Windows compliance policy whose Minimum OS version is above the laptop's build, so the laptop is Not compliant while it is assigned.

  BeforeDo not edit the shared Windows policy: raising its Minimum OS version would make every older laptop it is assigned to noncompliant at once. Instead create a separate test policy (Windows 10 and later) with only Minimum OS version set, and a device group whose one member is the test laptop. Run ver on the test laptop and note its version.

  DoIn the test policy, set Minimum OS version one revision above the test laptop's version in the 10.0 form (for example 10.0.26200.9975 for a laptop on 10.0.26200.9974), assign the test policy to that device group, sync, and sign in. Then set the test policy's Minimum OS version to exactly the laptop's version, sync, and sign in again.

  AfterwardsRemove the test policy's assignment (or delete the test policy) and the test device group, sync the test laptop, and check that Company Portal shows it Compliant on its normal Windows policy and the next sign-in is granted.

  ExpectAbove its version: the laptop shows Not compliant with Minimum OS version named, and the sign-in is refused. At its version: Compliant again and the sign-in is granted. This confirms that your tenant reads the value in the 10.0 form (Microsoft's page gives both 10.0 and 11.0; see the setting). If the laptop stays compliant in the first step, check the form before you rely on the shared policy's minimum.

A way around that should fail

• DoOn a compliant laptop, open Microsoft Edge InPrivate and sign in.

  ExpectRefused: Microsoft states that Edge in InPrivate mode on Windows is considered a noncompliant device.

  “Microsoft Edge in InPrivate mode on Windows is considered as a noncompliant device.”

• DoOn an unmanaged computer, change the browser's user agent to Linux or another platform and sign in.

  ExpectStill refused: the policy covers every platform, and the computer cannot show a compliant device record.

• DoList the users, groups and roles excluded from the policy.

  ExpectThe list holds the emergency access accounts (and the Directory Synchronization Accounts role if you use it), and nothing else. Any other exclusion is a way in: remove it or record why it exists.

When the service is unreachable

• DoLeave the test laptop switched off for longer than the compliance status validity period you chose (at least a day: the period is 1 to 120 days). Before switching it back on, find it in the Intune admin center under Devices > Monitor > Setting compliance, where this check is named Is active.

  ExpectIntune shows the laptop failing Is active, so it is treated as noncompliant and a sign-in from it is refused until it reports to Intune again.

• DoOn a laptop that cannot reach Microsoft's sign-in service at all, try to open company cloud apps.

  ExpectNothing signs in, because the check happens at sign-in. Files already synced to the laptop stay readable on it (see What this does not cover).

Recovery

• ChangesSwitches the compliant-device policy to Report-only, so no sign-in is refused for compliance until it is switched back to On.

  BeforeDo it at a time agreed for the test, with a second administrator watching, and note the policy's state (On) and the time.

  DoSign in with an emergency access account from a device that is not enrolled and switch the policy to Report-only.

  AfterwardsStill signed in with the emergency account, switch the policy back to On, then run the first Should be refused test again (the unenrolled personal laptop) and check that the sign-in log entry's Conditional Access tab, not Report-only, names the policy. Record both changes of state with their times in the change log.

  ExpectThe emergency account signs in with its passkey or certificate because it is excluded, and the change takes effect for later sign-ins. Afterwards the policy is On and the unenrolled laptop is refused again.

• DoOn the test laptop, turn the firewall back on and sync the device (Company Portal, or Settings > Accounts > Access work or school > Info > Sync).

  ExpectThe laptop shows Compliant again and the next sign-in is granted. Microsoft's Firewall note says to sync manually to re-evaluate the compliance status.

  “If the device immediately syncs after a reboot, or immediately syncs waking from sleep, then this setting may report as an Error. This scenario might not affect the overall device compliance status. To re-evaluate the compliance status, manually sync the device.”