Compliance Policies: Keeping Your Device Secure
Compliance Policies: The Rules of the Road
Compliance policies are the set of rules your IT team defines that your device must meet to be considered "compliant." Think of them like the safety inspection for your car — if your car doesn't pass inspection, you can't drive it on public roads. Similarly, if your device isn't compliant, you may not be able to access company resources.
What Compliance Policies Check
Here are the most common compliance checks your IT team might configure:
| Policy | What It Checks | Why It Matters |
|---|---|---|
| Operating system version | Is your OS updated to a minimum version? | Older OS versions have known security vulnerabilities |
| Screen lock / password | Does your device have a password or PIN? | Prevents unauthorized access if your device is lost or stolen |
| Encryption | Is the device's storage encrypted? | Protects data even if someone removes the hard drive |
| Antivirus / threat protection | Is Microsoft Defender or required antivirus running? | Detects and blocks malware before it causes damage |
| Firewall | Is the firewall enabled? | Blocks unauthorized network connections |
| Device health (attestation) | Is the device trustworthy (not rooted/jailbroken)? | Rooted or jailbroken devices bypass security controls |
| Maximum OS version | (Rare) Is your OS version not too new? | Some companies wait to approve new OS versions |
What Happens When You're Not Compliant
If your device falls out of compliance, here's what typically happens:
- You get a notification — Company Portal app shows a red warning and tells you what's wrong
- Grace period begins — IT usually sets a grace period (1-30 days) before enforcement kicks in
- Access gets blocked — After the grace period, you may lose access to:
- Work email (Outlook)
- Teams and SharePoint
- Company VPN
- Any resource protected by Conditional Access
- Access returns — Once you fix the compliance issue and sync, access is restored (usually within 15 minutes)
How to Fix Compliance Issues
Fixing compliance issues is straightforward:
- Open Company Portal
- Tap your device to see the compliance details
- Read what issue is flagged
- Follow the suggested action (update OS, enable encryption, change password)
- Tap "Sync" in Company Portal
- Wait 2-5 minutes for compliance status to update
Real-World Example
Scenario: You've been ignoring the Windows update notification for two weeks. One morning, Outlook stops syncing and shows "Your device is not compliant."
What happened: IT set a compliance policy requiring Windows 11 version 23H2 or higher. Your PC is on 22H2. The grace period expired.
How to fix:
- Open Company Portal — it says "OS version does not meet requirements"
- Go to Settings > Windows Update and install the latest update
- Restart your PC
- Open Company Portal and tap "Sync"
- Compliance status changes to green within 5 minutes
- Outlook starts syncing again
The Marking Period: Grace Periods Explained
IT doesn't block you immediately when you fall out of compliance. There's usually a grace period:
- 1-day grace period — Strict. You have one day to fix the issue before access is blocked.
- 7-day grace period — Common. Gives you a week to install updates or fix issues.
- 30-day grace period — Relaxed. Usually for less critical compliance settings.
During the grace period, you still have full access. Company Portal will warn you, but nothing is blocked yet. Once the grace period expires, Conditional Access enforcement kicks in.
What to Do If You Can't Fix It
If you can't resolve a compliance issue (e.g., your device is too old to update to the required OS version), contact IT. They may:
- Grant a temporary exception
- Issue you a new device
- Adjust the policy for your device
Beawit Consulting helps businesses design and implement Intune compliance policies. Contact us for security policy configuration and device management.
Next, we'll explore Conditional Access — the enforcement mechanism that blocks access when your device isn't compliant.
There are no comments for now.