Configuring compliance policies. This concept is the guard that decides whether a user's device is healthy enough to access company data. Without it, an employee's infected laptop could connect to your corporate network and leak sensitive information, which is exactly the kind of disaster the MD-102 exam wants you to prevent.
Jump to a section
A simple way to picture Configuring Compliance Policies
You are about to rent your first apartment. The landlord hands you a 10-page lease agreement, and you notice it says things like 'the tenant must keep the smoke detector batteries fresh', 'no pets over 20 kilograms', and 'rent is due on the first of each month'. You think, 'This is a list of rules I have to follow to live here.'
Now imagine you are the landlord. You own five buildings, each with 50 apartments. You cannot check every apartment every day to see if someone has a 25-kilogram dog. Instead, you write the rules into your master lease so that each tenant agrees to them when they sign. If a tenant breaks a rule — say, by not paying rent for 30 days — you have the legal right to start eviction proceedings.
This is almost exactly how compliance policies work in Microsoft 365. The 'lease' is your conditional access policy. The 'rules' are your compliance policies: minimum operating system version, require BitLocker encryption, require a PIN of at least six digits. The 'apartment' is a user's device — a laptop, phone, or tablet. When a user tries to access company email or files, the system checks their device against your compliance policy. If the device is non-compliant (the tenant broke a rule), the system blocks access or limits what they can do — just like you would evict a tenant who broke the lease. You do not need to inspect every device personally; the automated system enforces your rules 24/7.
Compliance policies are sets of rules that define the minimum security requirements a device must meet to be considered 'compliant'. Think of compliance as a health check for a device. When a device tries to access a company resource (like email, SharePoint, or a custom app), Microsoft 365 checks the device's compliance status. If the device fails the check, access can be blocked, limited, or the user can be prompted to fix the issue.
First, you need to understand the key components of a compliance policy:
Platform: The type of device the policy applies to, such as Windows 10/11, iOS/iPadOS, Android, or macOS. Each platform has different security features, so Microsoft 365 lets you create separate policies for each.
Settings: The actual rules the device must meet. Common settings include requiring a minimum operating system version, requiring BitLocker encryption on Windows, requiring a password or PIN of a minimum length, and requiring that the device is not jailbroken (on iOS) or rooted (on Android).
Actions for noncompliance: What happens when a device fails to meet a rule. The most common action is 'Mark device noncompliant', which triggers a conditional access policy to block access. Other actions include sending a notification to the user or setting a grace period during which the user can fix the issue before access is blocked.
Why do these policies exist? Before Microsoft 365, IT administrators managed device security manually. They would install antivirus on each computer, set password policies through local group policy, and physically check laptops for encryption. This was slow, error-prone, and impossible at scale for hundreds or thousands of devices. Compliance policies automate this enforcement. They are one part of a larger framework called Mobile Device Management (MDM), which lets IT control devices remotely.
The relationship between compliance policies and conditional access is crucial. Compliance policies do not block access by themselves. They simply evaluate the device and assign a compliance status (compliant or noncompliant). The actual blocking happens through conditional access policies. A conditional access policy says, 'If the device is marked noncompliant, block access to Exchange Online.' You need both pieces for the system to work.
A real example: You create a compliance policy for Windows 10 devices that requires BitLocker encryption. When a user's laptop tries to access company OneDrive, the device checks in with Microsoft Intune (the management service). Intune checks if BitLocker is on. If it is not, the device is marked noncompliant. The conditional access policy then blocks the user from opening any files until they enable BitLocker. The user sees a message on their screen telling them exactly what to fix.
Settings can also include 'device health' rules. For example, you can require that Microsoft Defender for Endpoint reports the device as healthy. This means the device has no active malware, its antivirus is up to date, and its firewall is on. This goes beyond simple password rules and checks the actual safety of the device.
Finally, you can create compliance policies for different groups of users. You might have a stricter policy for executives who handle sensitive financial data, and a more lenient policy for interns. You do this by assigning the policy to Entra ID groups (formerly Azure AD groups). This allows you to tailor security based on user risk.
Step 1: Sign in and navigate
Go to the Microsoft Intune admin centre at https://endpoint.microsoft.com. Select 'Devices' in the left menu, then select 'Compliance policies'. This is the central location for creating and managing all compliance rules. The same console also manages configuration profiles and update rings.
Step 2: Create a new policy
Click 'Create policy'. You are prompted to select a platform: Windows 10 and later, iOS/iPadOS, Android, or macOS. This choice determines which settings are available. For example, BitLocker appears only for Windows, and FileVault appears only for macOS. If you select the wrong platform, the policy will not apply to devices correctly.
Step 3: Configure settings
A list of settings appears, organised into categories like 'Device Health', 'System Security', and 'Microsoft Defender for Endpoint'. Enable settings such as 'Require BitLocker', 'Minimum OS version', and 'Require a password to unlock mobile devices'. Each setting has a toggle or dropdown. Read descriptions carefully because some settings require additional configuration (like health attestation needing Windows 10 1809 or later).
Step 4: Set actions for noncompliance
After configuring settings, you define what happens when a device fails. The default action is 'Mark device noncompliant'. You can add additional actions like 'Send notification to end user' (which emails or pushes a message to the user explaining the issue) and 'Set grace period' (e.g., allow the device 7 days to become compliant before marking it noncompliant). This step is critical because it determines the user experience.
Step 5: Assign the policy to groups
Select 'Next' to the 'Assignments' tab. Choose Microsoft Entra ID groups (e.g., 'All Users', 'Finance Team', or 'Windows Devices'). You can include groups (apply policy to these users) or exclude groups (skip policy for these users). You must assign to at least one group, or the policy will be created but not enforced. After assignment, click 'Create'. The policy is now live and will be evaluated on the next device check-in.
Step 6: Create a linked conditional access policy
The compliance policy alone does not block access. Go to Microsoft Entra ID > Security > Conditional Access and create a policy that says: 'Grant: Require device to be marked compliant' and 'Access controls: Block access if not compliant'. Target 'All cloud apps' or specific ones like Exchange Online. This final step gates resource access based on compliance status.
An IT professional working at a medium-sized company with 200 employees would use compliance policies every day. Here is a realistic scenario:
Sarah is the IT administrator at a legal firm. The firm has 150 Windows laptops, 40 iPhones, and 10 Android tablets. The managing partner tells Sarah that a new client requires all devices accessing the client's data to be encrypted and have a passcode of at least 8 characters. If a device does not meet these rules, the firm could lose the client contract.
Sarah does the following step by step:
She logs into the Microsoft Intune admin centre (the main dashboard for managing devices).
She navigates to 'Devices' and then 'Compliance policies'.
She creates three separate policies: one for Windows, one for iOS, and one for Android.
For the Windows policy, she selects the setting 'Require BitLocker' and sets the minimum OS version to Windows 10 22H2. She sets the action for noncompliance to 'Mark device noncompliant' and 'Send notification to user'.
For the iOS policy, she sets a minimum passcode length of 8 characters, requires the device not to be jailbroken, and requires the device to be encrypted.
She assigns all three policies to a Microsoft Entra ID group called 'All Users', which includes every employee.
She creates a conditional access policy in Microsoft Entra ID that says: 'If device compliance status equals noncompliant, block access to all cloud apps except the app that allows the user to register their device'.
The next morning, 15 employees see a notification on their phone saying their device is not compliant. One employee, Tom, has an Android phone that is rooted. Rooting gives the user superuser access, which can bypass security controls. Tom cannot access his work email on that phone until he removes the root. Another employee, Lisa, has a Windows laptop that does not have BitLocker enabled. She clicks the notification, and it opens Windows settings to let her turn on BitLocker. Within 10 minutes, her laptop is compliant.
What does Sarah actually do day to day? She monitors the compliance dashboard in Intune to see how many devices are noncompliant. She creates reports to show the managing partner that all devices meet the client's requirements. When a new device type appears (e.g., someone brings a personal iPad), she adjusts the policy or creates a new one. She also sets grace periods so users have time to update their operating system before losing access.
Key actions Sarah performs regularly:
Review and update compliance policies when new OS versions are released (e.g., Windows 11 requires a new policy setting).
Exclude certain users (like the CEO) from a policy if they have a legitimate reason to bypass a rule, while still maintaining security.
Use the 're-evaluate' button in Intune to force a policy check immediately, rather than waiting for the device to check in automatically (which happens every 8 hours).
Troubleshoot why a device shows as noncompliant by looking at the device's policy status page, which lists each setting and whether it passed or failed.
The MD-102 exam tests your ability to create, configure, and manage compliance policies. It does not ask you to spell out every registry key. Instead, it tests conceptual understanding and decision-making. Here is what you need to know perfectly:
Question types that appear:
Multiple choice: 'Which policy setting would you configure to ensure a device has a password?'
Case study: You are given a scenario with two devices (one managed, one unmanaged) and asked what policy to apply.
Drag and drop: Match the compliance setting to its platform (e.g., BitLocker for Windows, FileVault for macOS).
What they love to test: - Platform-specific settings: Know that BitLocker is Windows-only, FileVault is macOS-only, and the standard encryption on iOS/iPadOS is 'not jailbroken'. - Actions for noncompliance: The exam frequently asks what happens when a device is noncompliant. Remember that the action is separate from the conditional access blocking. The default action is 'Mark device noncompliant'. - Assignment to groups: You must know that policies are assigned to Microsoft Entra ID groups, not individual users directly (though a group can have one user). - Grace periods: The exam tests that you can set a 'grace period' for specific actions (like requiring the user to update their OS within 7 days before marking noncompliant). - Device health attestation: Windows devices can use 'health attestation' which checks if secure boot is on, if BitLocker is on, and if the device is booting from a trusted source. This is called 'Windows Health Attestation Service' (WHAS). The exam often includes this.
Traps they set:
Trap 1: They ask 'Which setting blocks access to email?' The correct answer is usually 'configuring a conditional access policy that uses device compliance', not the compliance policy itself.
Trap 2: They ask 'What is the default check-in interval for a device to re-evaluate compliance?' It is 8 hours, not 1 hour or 24 hours.
Trap 3: They present a scenario with a user who has two phones. The question might ask which compliance policy applies. The answer is: each device is evaluated independently against the policies assigned to the user's group.
Trap 4: They ask about 'compliance policies vs configuration profiles'. Configuration profiles set device settings (like wallpaper or Wi-Fi), while compliance policies only check if settings are present. They are different tools.
Key definitions to memorise: - Compliance policy: A set of rules a device must meet. - Conditional access: The gate that uses compliance status to allow or block access. - Noncompliant action: What Intune does when a rule is broken. - Health attestation: A Windows-specific feature that verifies device integrity at boot. - Platform: The operating system type (Windows, iOS, Android, macOS).
Exam tip: Always read the scenario carefully. If the scenario says 'users report that they cannot access email but they can access the device registration portal', the device is noncompliant, and the conditional access policy allowed them through to the registration page deliberately.
Compliance policies are rules that define minimum security requirements for devices, not enforcement tools — conditional access does the blocking.
Each device is evaluated independently against compliance policies, regardless of who owns it.
You must assign compliance policies to Microsoft Entra ID groups to target specific users or devices.
Common compliance settings include requiring encryption, a minimum OS version, a password, and device health attestation.
A grace period allows users time to remediate noncompliance before access is blocked.
Platform-specific settings exist: BitLocker for Windows, FileVault for macOS, and jailbreak/root detection for mobile devices.
Intune automatically re-evaluates device compliance every 8 hours by default.
Compliance policies are managed in the Microsoft Intune admin centre under Devices > Compliance policies.
These come up on the exam all the time. Here's how to tell them apart.
Compliance Policy
Checks if a security setting is present.
Does not change device settings, only reports on them.
Used for conditional access blocking.
Configuration Profile
Actively applies settings to devices.
Can change passwords, install Wi-Fi profiles, etc.
Does not directly affect access, only configures the device.
Compliance Policy
Runs on the device side via Intune.
Outputs a simple compliant/noncompliant status.
Cannot block access directly; it only evaluates.
Conditional Access Policy
Runs on the server side in Microsoft Entra ID.
Uses compliance status as one condition among many.
Actually blocks or allows access to resources.
Standard Compliance Policy
Checks generic settings like password and encryption.
Works on all platforms (Windows, iOS, Android, macOS).
Does not check boot-level integrity.
Device Health Attestation
Checks Windows-specific boot security (Secure Boot, BitLocker).
Windows 10/11 only.
Verifies the device has not been tampered with at boot.
Mark Noncompliant (Action)
Changes device status to noncompliant.
Triggers conditional access to block access.
Has no direct communication with the user.
Send Notification (Action)
Sends an email or push notification to the user.
Does not change compliance status by itself.
Is used alongside 'Mark Noncompliant' to inform the user.
Mistake
Compliance policies block access by themselves without any other configuration.
Correct
Compliance policies only evaluate and mark a device as compliant or noncompliant. They do not block access. You must also create a conditional access policy in Microsoft Entra ID that uses the compliance status to actually block or allow access.
Beginners see the word 'policy' and assume it is a direct enforcement tool, missing the two-step architecture. The exam specifically tests this distinction.
Mistake
A compliance policy applies to the user, so if a user has a compliant phone, their laptop is also compliant.
Correct
Compliance policies are evaluated per device, not per user. Each device owned by a user is checked individually. A user could have a compliant iPhone and a noncompliant Windows laptop at the same time.
People think in terms of user identity rather than device identity, because most apps ask for a username and password. The exam exploits this confusion in scenario questions.
Mistake
You can require a specific antivirus brand (e.g., Norton or McAfee) through a compliance policy.
Correct
You can only require that antivirus is enabled and reporting as active, not a specific brand. The built-in Windows Defender integration is what Intune checks, not third-party AV.
Candidates get confused because they see antivirus-related settings in the console but do not realise the scope is generic. The exam has a trap where a third-party AV is mentioned as a distractor.
Mistake
If a device is noncompliant, the user is immediately permanently blocked from all access.
Correct
You can configure a 'grace period' that gives the user time to fix the issue (e.g., update their OS) before the block is enforced. During the grace period, the device is still marked noncompliant but access is not yet blocked.
Users default to thinking of enforcement as binary (yes/no) without considering time-based remediation. The exam tests your understanding of grace periods as a configuration option.
Mistake
Compliance policies are the same as 'update rings' or 'Windows Update for Business policies'.
Correct
Compliance policies check if updates are installed, but they do not install updates. Update rings are separate policies that manage when and how devices receive updates. Compliance policies just validate the outcome.
Both involve updates, and Microsoft's UI lists them under similar categories, causing confusion. The exam expects you to distinguish their purposes.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A compliance policy is a set of rules (like 'require a password' or 'require encryption') that a device must meet. If the device fails, it is marked as noncompliant, which can trigger conditional access to block access to company resources.
In the Intune admin centre, go to 'Devices' then 'All devices', click on a device, and check the 'Compliance' tab. It lists each setting and whether it passed or failed, along with the overall compliance status.
A compliance policy only checks if a setting is present (e.g., 'Is encryption enabled?'). A configuration profile actively sets the setting (e.g., 'Enable encryption'). They are complementary: you might use a configuration profile to enforce encryption and a compliance policy to verify it.
By default, devices check in with Intune every 8 hours to re-evaluate compliance. You can force a refresh from the Intune console by selecting the device and clicking 'Sync'. The user can also manually sync from the Company Portal app on their device.
Yes. Create separate policies and assign each one to different Microsoft Entra ID groups. For example, you might have a stricter policy for executives assigned to a 'VIP Users' group, and a standard policy for everyone else.
The device is marked noncompliant in Intune. If you have a conditional access policy that requires compliance, the user is blocked from accessing company resources like email or SharePoint. The user receives a notification explaining what needs to be fixed.
You've finished Configuring Compliance Policies. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?