Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'

Contributed by Henrik Piecha with Merill FernandoAll contributors →

Part of Maester · Intune · Device compliance · All checks

Run this check

Invoke-Maester -TestId MT.1054

Overview

Ensure the built-in Device Compliance Policy marks devices with no compliance policy assigned as ‘Not compliant’.

Set your Intune built-in Device Compliance Policy to mark devices with no compliance policy assigned as ‘Not compliant’. This ensures that new devices that do not have any policies assigned are not compliant per default.

Remediation action:

To change the built-in device compliance policy:

1. Navigate to Microsoft Intune admin center.
2. Click Devices scroll down to Manage devices.
3. Select Compliance and Select Compliance settings.
4. Set Mark devices with no compliance policy assigned as to Not compliant
5. Click Save.

Related links

• Microsoft 365 Admin Center
• Microsoft Intune - Compliance
• Compliance policy settings

Details

Every attribute of this check

Field	Value
Test ID	MT.1054
Severity	Medium
Suite	Maester
Product	Intune
Feature	Device compliance
Area	Devices and endpoints
Resource type	Tenant
User impact	Medium
Implementation cost	Medium
MITRE ATT&CK	T1078.004 Cloud Accounts
Supports controls	nist-800-53-r5:AC-19, nist-800-53-r5:CM-6
PowerShell test	Test-MtDeviceComplianceSettings
Services	Graph
Compatible licenses	INTUNE_A

Source

• Test: tests/maester/intune/Test.MT.1054.ps1
• Documentation: tests/maester/intune/Test.MT.1054.md