Monitoring Devices with Reports and Alerts. If you manage more than one device, you cannot physically check each one every day. Reports and alerts do the watching for you, turning thousands of device settings into a single dashboard that tells you what is compliant, what is broken, and what needs immediate attention. For the MD-102 exam, this is the difference between knowing your environment is healthy and being blindsided by a security breach.
Jump to a section
A simple way to picture Monitoring Devices with Reports and Alerts
A school crossing supervisor stands at a busy pedestrian crossing near a primary school. Their job is not to drive the cars or walk the children themselves. Their job is to watch. They hold a stop sign, check both directions, and decide exactly when it is safe for a group of children to cross. They do not assume every car will stop. They look. They wait. They confirm.
If a driver runs the red light or swerves dangerously, the supervisor blows a whistle and notes the number plate. They do not chase the car, but they record the problem and report it to the local traffic office. That report becomes an alert. The traffic office can then decide whether to send a warning letter, add more signage, or increase police patrols.
Now map this to Intune device monitoring. The crossing supervisor is Intune. The children are your organisation’s devices — laptops, phones, tablets. The crossing is your compliance policy: the rule that a device must have a password, antivirus software, and a recent OS version before it can access company email. The supervisor watches every device attempt to 'cross' into your corporate resources. If a device fails the check — no password, outdated antivirus, or missing encryption — Intune blows the digital whistle by generating an alert and a report. The IT team, like the traffic office, sees exactly which device failed, why it failed, and can take action to fix it, block it, or warn the user.
Let us start with a simple truth: in a business with even 50 employees, you cannot walk around checking each laptop for antivirus updates. You cannot ring every person to ask if their screen lock is enabled. That is the problem monitoring solves. Monitoring is the automated process of checking device health and compliance without human effort. It uses two main tools: reports and alerts.
A report is a static snapshot. It is a list, a chart, or a table that shows the current state of your devices at a specific moment. If you generate a compliance report on Monday morning, it tells you exactly which devices passed your rules and which did not. Reports are good for understanding trends over time — did compliance improve after you emailed everyone? Did ten devices fall out of compliance after a weekend?
An alert is a dynamic notification. It fires when something specific happens — a device becomes non-compliant, a threat is detected, or a device fails to check in for more than 30 days. Alerts are designed to grab your attention immediately. They come as emails, push notifications, or dashboard badges. You do not have to look for problems; the problems come to you.
Microsoft Intune, which is the core tool for managing devices in Microsoft 365, provides both. Intune is a cloud-based service that lets you define policies — rules about what a device must have to be considered healthy. A policy might say: every device must have BitLocker encryption turned on, Windows Defender Antivirus running with real-time protection, and a PIN or password of at least six characters.
When you apply that policy to your devices, Intune starts checking. It does not guess. It contacts each device through the Microsoft Intune Management Extension or the Company Portal app and asks for its current settings. The device replies: 'I have BitLocker on. antivirus active. password set to eight characters.' Or it replies: 'I have no password. Antivirus is off.' Intune records that answer.
Now here is the key concept for the exam: compliance is not binary in the way beginners think. There are three states. Compliant means the device meets all policy rules. Non-compliant means it fails at least one mandatory rule. Unknown means Intune has not heard from the device recently — it might be off, offline, or broken. The exam loves to test your understanding of the 'Unknown' status. A device that has not checked in for 30 days is marked as non-compliant by default, not unknown. That is a trap.
Reports in Intune live in the Microsoft Intune admin centre, under the 'Devices' section and then 'Monitor'. You will see reports like 'Device compliance', 'Non-compliant devices', 'Device health', and 'Antivirus status'. Each report is filterable. You can say: show me only Windows devices that are non-compliant because of missing encryption. You can export the list to a CSV file and share it with your helpdesk.
Alerts in Intune are configured through 'Compliance policies' and 'Notification rules'. You can set it so that when a device becomes non-compliant, an email is sent to the IT team. You can also set it so that the device itself shows a message to the user: 'Your device does not meet company security standards. Please contact IT.'
Why does all this matter for the MD 102 exam? Because the exam tests whether you know where to find each report, what each report means, and how to configure notifications. You might be given a scenario: 'A user reports that their device shows as compliant, but they cannot access email. What do you check?' The answer is often 'Check the device compliance report for an unknown status' or 'Check the conditional access policy'. Conditional access is the gatekeeper that uses compliance data. Even if a device is compliant, if the conditional access policy says 'Require compliant device' and the device status is unknown, access is blocked. Understanding the relationship between compliance reports and conditional access is critical.
In summary, monitoring with reports and alerts replaces the impossible job of manually checking every device. It gives you a centralised view, automatic warnings, and the ability to enforce rules without interrupting users unnecessarily.
Define your compliance policies
Before monitoring, you must decide what 'healthy' means. Create a policy in Intune that requires a password, encryption, antivirus, and OS version. This becomes the baseline for all reports and alerts.
Assign the policy to your devices
Apply the compliance policy to user groups or device groups. Without assignment, the policy exists but is not checked against any device, so reports will show nothing.
Wait for devices to check in
Devices periodically communicate with Intune. Check-in frequency varies (typically every 8 hours). Without a check-in, Intune cannot evaluate compliance. This is why 'Unknown' status occurs.
Review the Device compliance report
Navigate to Devices > Monitor > Device compliance. This report lists each device, its status, and the specific rules it passed or failed. Use filters to isolate non-compliant or unknown devices.
Configure notification rules for alerts
Go to Tenant administration > Notification rules and create rules that trigger when a device becomes non-compliant, fails to check in, or detects a threat. This is how alerts become active.
Respond to alerts and update the report
When an alert arrives, investigate the specific device. Resolve the issue (e.g., enable encryption) and verify the device re-checks in. The next report will update to show the device as compliant.
Picture this. You are the sole IT administrator for a medium-sized architecture firm with 120 employees. They use a mix of Windows laptops, iPhones, and Android tablets. Your boss had a scare last month when a junior architect's laptop was stolen and the device was not encrypted. Fortunately, nothing leaked, but the boss now wants proof that every device is encrypted.
You log into the Microsoft Intune admin centre. You go to Devices > Monitor > Device compliance. You run the report. You see that 100 devices are compliant, 12 are non-compliant, and 8 are unknown. That is your starting point.
You filter the non-compliant list by 'Missing BitLocker encryption'. Four devices show up. You click on one. Intune tells you the device is a Windows laptop used by a senior architect named Sarah. You also see the last check-in time was three days ago. You pick up the phone and call Sarah. 'Sarah, your laptop is showing as missing encryption. Can you come by IT so I can check it?' Sarah says she turned off BitLocker because it slowed down her CAD software. Now you know the issue is not technical — it is a user preference that violates policy. You explain the security requirement and re-enable BitLocker. The device checks in again and becomes compliant.
Next, the 8 unknown devices. You run a separate report: 'Devices that haven't checked in for 30 days'. Three devices appear. They are old iPads that were used by former employees and never wiped. You can now retire those devices from Intune, removing them from your compliance statistics.
The remaining 5 unknown devices are actually turned off or disconnected. You decide to configure an alert. You go to Tenant administration > Notification rules > Create notification rule. You set the rule: 'When a device becomes non-compliant due to missing encryption, send an email to IT-team@company.com.' You also set a rule: 'When a device has not checked in for 14 days, send a warning email to the device user and CC IT.' Now you will know proactively, before a problem escalates.
Later that week, you get an alert email. A new non-compliant device appears. A salesperson bought a personal tablet and tried to access company email. Intune detected it as an unmanaged device. The compliance policy flagged it immediately. You can now block access using conditional access: require device compliance. The user cannot get to email until they enrol the device in management and meet your policies.
This real-world flow shows how reports give you the overall picture, how alerts catch emerging problems, and how you take targeted action without wasting time on devices that are fine. It is not theoretical. It is how you maintain security in a busy, real organisation.
The MD-102 exam tests your ability to navigate the Intune admin centre and interpret monitoring data. Here is exactly what you need to know and the traps to avoid.
First, you must know the difference between a compliance policy report and a configuration policy report. A compliance policy report tells you whether a device meets security rules. A configuration policy report tells you what settings were applied to a device. The exam will give you a scenario and ask: 'Which report should you check to see if a device has BitLocker enabled?' The answer is the compliance report. If they ask 'Which report shows what antivirus software is installed?' that is a configuration report.
Second, know the three compliance statuses: compliant, non-compliant, unknown. The exam loves the 'unknown' status. Trap: a device that has not checked in for 5 days is still 'unknown', not non-compliant. However, Intune has a default grace period of 30 days. After that, the device is automatically marked as non-compliant. You can change this grace period. The exam may ask: 'A device has been offline for 45 days. What is its compliance status?' The correct answer is non-compliant.
Third, you must understand the relationship between compliance policies and conditional access policies. Conditional access policies use compliance data to grant or block access. The exam will present a scenario where a device is compliant but still blocked from email. The answer is typically 'Check the conditional access policy — it might require a specific client app or location in addition to compliance.'
Fourth, know the alert types: 'device non-compliance', 'device health', 'threat detected', and 'device check-in failure'. The exam may ask: 'Which alert will fire when a device fails to communicate with Intune for 14 days?' The answer is 'Device check-in failure'. They may also ask about 'device health' alerts, which are related to Windows Defender status.
Fifth, you need to know how to filter and export reports. The exam might ask: 'You need to send a list of all non-compliant Windows devices to your manager. What do you do?' The answer: 'Go to Devices > Monitor > Device compliance, filter by platform and status, then export to CSV.'
Key definitions to memorise:
Compliance policy: a set of rules applied to devices.
Conditional access: a policy that evaluates compliance before granting access.
Unknown status: device has not checked in within the configured grace period.
Notification rule: an alert configuration that triggers an email or message based on a compliance event.
Device health report: shows antivirus, firewall, and threat status.
Common exam traps:
Confusing 'compliance' with 'configuration'.
Believing that unknown means non-compliant (it does not, until the grace period expires).
Forgetting that conditional access can block access even for compliant devices if other conditions are not met.
Assuming alerts are enabled by default (they are not — you must configure notification rules).
Compliance policies define the rules a device must meet, but they do not automatically send alerts — you must configure notification rules separately.
The three compliance statuses are Compliant, Non-compliant, and Unknown; unknown does not mean non-compliant until the grace period expires.
Reports are static snapshots taken at device check-in, not live data streams; always consider the last check-in time when interpreting a report.
Conditional access policies use compliance data as one of many signals to grant or block access to resources.
The Device health report focuses on security health (antivirus, firewall, threats) not hardware health.
You can export any compliance or health report to CSV for sharing with managers or for offline analysis.
Notification rules can send emails to IT, show in-app messages to users, or both, depending on how you configure them.
A device that has not checked in for 30 days is automatically marked non-compliant, but you can adjust this grace period.
These come up on the exam all the time. Here's how to tell them apart.
Compliance Policy
Defines the rules a device must meet (e.g., password, encryption)
Evaluates the device's internal settings
Result is a compliance status: compliant, non-compliant, unknown
Conditional Access Policy
Uses compliance status as one of many signals to decide access
Evaluates user, location, app, device state, and sign-in risk
Result is grant, block, or require additional controls (like MFA)
Report
Static snapshot of device states at a point in time
You must open the report to see the data
Good for trend analysis and historical comparison
Alert
Dynamic notification triggered by a specific event
Comes to you via email, push, or dashboard badge
Good for immediate action on urgent issues
Compliant Status
Device meets all mandatory rules in the compliance policy
Access is typically granted by conditional access (if other conditions met)
Green icon in the report
Non-compliant Status
Device fails at least one mandatory rule
Access is typically blocked by conditional access
Red icon in the report
Unknown Status
Device has not checked in for less than the grace period (default 30 days)
Not automatically blocked — may still have access if conditional access allows
Yellow icon in the report
Non-compliant Status (after grace period)
Device has not checked in for more than the grace period
Automatically treated as non-compliant and access is blocked
Red icon in the report
Mistake
If a device is marked compliant, it can always access company resources without restriction.
Correct
Compliance is a necessary condition, but not sufficient. Conditional access policies may require additional conditions like a specific location, app, or sign-in risk level before granting access.
Many beginners assume compliance equals automatic access because they focus only on the device policy and ignore the conditional access layer.
Mistake
The 'Unknown' compliance status means the device is not compliant and should be blocked immediately.
Correct
Unknown simply means Intune has not received a recent check-in from the device. It is not automatically non-compliant until the configured grace period (default 30 days) expires.
The word 'unknown' sounds alarming, so beginners assume it is a problem. In reality, it often means the device is turned off, in airplane mode, or temporarily offline.
Mistake
Reports update in real-time, so you can trust the data you see at any moment for immediate decisions.
Correct
Reports are snapshots based on the last check-in of each device. Check-ins are not continuous. A device may have checked in hours ago, so the report may not reflect a recent change immediately.
Users are accustomed to real-time dashboards (like website analytics) and assume Intune reports behave the same way. They do not realise device management relies on periodic polling.
Mistake
Configuring a compliance policy automatically sends alerts to the IT team when a device violates the policy.
Correct
Compliance policies enforce rules but do not send alerts on their own. You must create separate notification rules to trigger emails or messages when a device becomes non-compliant.
The word 'policy' implies active enforcement and monitoring, so beginners assume alerts are built in. They overlook the separate 'Notification rules' feature.
Mistake
The device health report shows the physical health of the device, such as battery status or hard drive failure.
Correct
Device health in Intune refers to security health — antivirus status, firewall state, threat detection. It does not monitor hardware health like disk or battery.
The term 'health' is broad in everyday language, leading beginners to think it covers hardware diagnostics. Intune's scope is security and configuration, not hardware.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
A compliance report tells you whether devices meet security rules (like encryption or password). A configuration report tells you what settings were applied to a device (like which apps are installed). They serve different purposes.
It means Intune has not received a check-in from that device recently. The device might be turned off, offline, or the Intune management agent is not running. It is not automatically non-compliant until the grace period expires.
You need to create a notification rule in Intune under Tenant administration > Notification rules. Set the condition to 'Device non-compliance' and add your email address as the recipient.
Yes. In the Device compliance report, click on a non-compliant device. The details pane shows a list of each compliance rule and whether the device passed or failed that specific rule.
If you have configured conditional access to require compliant devices, the user will be blocked. They will see an error message and should contact IT. You can also configure a compliance policy to send a notification to the user directly.
Typically every 8 hours for most settings, but some checks (like threat status) can happen more frequently. You cannot manually force a check-in from the admin centre — the user can trigger it from the Company Portal app.
You've finished Monitoring Devices with Reports and Alerts. Continue through the MD-102 study guide to build a complete picture of the exam.
Done with this chapter?