How to bring non-compliant devices into compliant in Intune?

Vinod Survase 4,716

How to bring non-compliant devices into compliant in Intune? We have many devices become as non-compliant and wanted to bring them back to compliant, so how to do that? Are there any steps and solutions to make this change in bulk or we need to make one by one?

Rahul Jindal [MVP] 9,551 Reputation points MVP

2023-04-07T18:07:55.96+00:00

It will depend on what all the devices are non-compliant against. Have you identified that yet?
Vinod Survase 4,716 Reputation points

2023-04-12T09:24:37.7133333+00:00

Hi @Rahul Jindal [MVP] , Yes I have identified all those devices and each device has some parameters are not meeting which are stated in compliance policy. Can you check my answer to @Crystal-MSFT questions and suggest a solution as I am not able to rectify it.

1 answer

Crystal-MSFT 45,571 Reputation points Microsoft Vendor

2023-04-10T01:53:44.17+00:00
@Vinod Survase, Thanks for posting in Q&A.

To troubleshoot the non-compliant issue, we can follow the following steps:

In Intune portal, go to Devices-All devices, find one affected device, Click Device Compliance and then we will see which policy is not compliant.'

Then click the policy, we will see which setting is not compliant.

After we find the not compliant setting, we can go to the device side to make it meet the requirement of compliance policy.

If the non-compliance setting is not the same, we need to do it one by one on the device side to make it meet the compliance policies.

Hope it can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Vinod Survase 4,716 Reputation points

2023-04-10T08:40:48.9433333+00:00

Thanks @Crystal-MSFT , Will check this and resolve it.

Crystal-MSFT 45,571 Reputation points Microsoft Vendor

2023-04-11T01:31:54.9533333+00:00

@Vinod Survase, Thanks for the reply. I notice you will check on this. If there's anything we can help, feel free to let us know.

Vinod Survase 4,716 Reputation points

2023-04-12T09:22:00.8266667+00:00

Hi @Crystal-MSFT , I have checked this and I found that there are different errors plus Non-compliant states. See attached below

So how to resolve this as its for both type of devices corporate owned and personal devices as well?

Rahul Jindal [MVP] 9,551 Reputation points MVP

2023-04-12T09:31:58.4833333+00:00

For the compliance state reporting as Not applicable, there is nothing you can do. They are just not applicable and will not affect the device compliance. For devices reporting as remediation failed, they should automatically correct themselves after a couple of hours. In case of BitLocker, it maybe a case of device requiring a reboot. For everything else that is reporting not compliant, you just have to find a way to correct them. Either physically on the devices or script them or push down relevant policies (Example upgrading the OS through Update ring to meet the minimum OS version).

Vinod Survase 4,716 Reputation points

2023-04-12T10:18:21.28+00:00

Thanks for reply on @Rahul Jindal [MVP] , Can you elaborate more on script which I need to use or may be do it in bulk for those non-compliant devices.

Crystal-MSFT 45,571 Reputation points Microsoft Vendor

2023-04-13T06:07:42.91+00:00

@Vinod Survase, For NotApplicable, we can ignore because the setting is not applicable to the device. For the other setting, one is with minimum password length and the other is for BitLocker,

For the Minimum password length, I find it controls the password length for local account. Please change the local account password length to meet the requirement.

https://video2.skills-academy.com/en-us/windows/client-management/mdm/policy-csp-devicelock#devicelock-mindevicepasswordlength

For the BitLocker not compliant, please ensure the BitLocker is enabled on the device.

Vinod Survase 4,716 Reputation points

2023-04-13T08:45:31.0366667+00:00

Thanks @Crystal-MSFT Will check and make the appropriate changes.

Crystal-MSFT 45,571 Reputation points Microsoft Vendor

2023-04-14T01:56:21.5366667+00:00

@Vinod Survase, Thanks for the reply. If there's anything we can help, feel free to let us know.

John Lee 0 Reputation points

2023-04-17T20:18:01.6233333+00:00

How do we change devices that are marked non-compliant for DefaultDeviceCompliancePolicy.RequireRemainContact to be compliant again? I have a user who was away on vacation for 30+ days and their access is limited because their device is non-compliant in Intune.

Crystal-MSFT 45,571 Reputation points Microsoft Vendor

2023-04-18T01:55:23.22+00:00

@John Lee, Thanks for the reply. For your situation, here are my suggestions:

You can consider changing the "Compliance status validity period (days)" to a higher value.

Ask the user to connect to Internet to make it contact Intune to check in and sync in a scheduled time. If the device can't contact Intune, then the state will be non-compliant, if there's no conditional access policy with compliant device requirement, then you can let it there. Hope the above information can help.

Vinod Survase 4,716 Reputation points

2023-04-20T09:56:03.9466667+00:00

@Crystal-MSFT I am good on this. Got the answer

Crystal-MSFT 45,571 Reputation points Microsoft Vendor

2023-04-21T01:48:12.6433333+00:00

@Vinod Survase, Thanks for the reply. I am glad to hear that everything is going well. If there's anything else we can help, feel free to let us know.
Sign in to comment

Share via

How to bring non-compliant devices into compliant in Intune?

1 answer