MT.1231 - Ensure iOS compliance policy requires a Defender machine risk score level.
Overview
Ensure at least one assigned iOS compliance policy requires a Microsoft Defender machine risk score level.
Microsoft Defender for Endpoint on iOS calculates a machine risk score for every onboarded device from what it detects on it: malicious or phishing web traffic, a jailbreak, a known bad app, an unsafe network. Intune compliance policy consumes that verdict through Require the device to be at or under the machine risk score, so an iPhone whose risk rises above an accepted threshold is marked non-compliant and can then be blocked by Conditional Access.
Without this setting the detection never reaches the access decision. A phone with an active high severity detection stays compliant and keeps its access to corporate resources, which removes exactly the automatic containment that a Zero Trust architecture assumes is present. Detection without enforcement leaves a compromised phone fully trusted.
The threshold accepts Secured, Low, Medium and High. High admits every score Defender reports, so a policy set to High is reported by this test but does not count towards a pass: the threshold exists and no detection ever makes the device non-compliant. The values unavailable and notSet mean the risk score is not evaluated at all, and neither counts as configured either. A pass needs Secured, Low or Medium.
A threshold has no effect until the devices are actually onboarded to Defender for Endpoint and the Intune connector is enabled for iOS. This test reports whether the threshold is paired with Require the device to be at or under the device threat level, so a threshold that can never evaluate is visible. MT.1098 checks the health of the connectors themselves.
Scope limitation
This test reads the Defender for Endpoint machine risk score threshold. A tenant that uses a third party mobile threat defense connector instead configures a separate threshold property, which this test does not read, so such a tenant can fail this check while being correctly configured. Check the connectors in the Intune admin center before acting on a failure here.
Policies that are not assigned to any group are reported by this test but do not count towards a pass, because an unassigned compliance policy is never evaluated against any device.
Remediation action
- Navigate to the Microsoft Intune admin center.
- Confirm the Defender for Endpoint connector is enabled under Endpoint security > Microsoft Defender for Endpoint, and that Connect iOS/iPadOS devices is set to On.
- Go to Devices > Manage devices > Compliance.
- Select an existing iOS/iPadOS policy, or select + Create policy with Platform set to iOS/iPadOS.
- Under Compliance settings > Microsoft Defender for Endpoint, set Require the device to be at or under the machine risk score to Medium or stricter.
- On the Assignments tab, assign the policy to your iOS device or user groups.
- Select Next and then Create or Save.
Related links
- Microsoft Intune admin center - Device compliance
- Microsoft Learn - iOS/iPadOS compliance settings in Intune
- Microsoft Learn - Mobile Threat Defense with Intune
- Microsoft Learn - Deploy Microsoft Defender for Endpoint on iOS
Test Metadata
| Field | Value |
|---|---|
| Test ID | MT.1231 |
| Severity | Medium |
| Suite | Maester |
| Product | Intune |
| Related products | Defender |
| Feature | Device compliance |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Medium |
| MITRE ATT&CK | T1078.004 Cloud Accounts |
| Supports controls | nist-800-53-r5:SI-4, nist-800-53-r5:AC-19 |
| PowerShell test | Test-MtIosDefenderRiskScore |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/maester/intune/Test.MT.1231.ps1 - Documentation:
tests/maester/intune/Test.MT.1231.md