Why Intune Device Noncompliance Is Often Due to Sync Issues
Exhibit
{
"@odata.context": "https://graph.microsoft.com/v1.0/$metadata#deviceManagement/managedDevices/$entity",
"id": "12345678-1234-1234-1234-123456789012",
"deviceName": "DESKTOP-ABC123",
"operatingSystem": "Windows",
"osVersion": "10.0.22621.1",
"managementState": "managed",
"complianceState": "noncompliant",
"lastSyncDateTime": "2025-03-15T10:00:00Z",
"enrolledDateTime": "2025-01-01T08:00:00Z",
"ownerType": "company",
"userDisplayName": "John Doe"
}Refer to the exhibit. The exhibit shows a JSON representation of a managed device from Microsoft Graph API. The device shows as noncompliant. Which of the following is the most likely reason for the noncompliant status?
Quick Answer
The answer is that the device is noncompliant because it has not synced recently, as indicated by the lastSyncDateTime in the JSON being far older than the current time. Intune compliance policies include a “Device check-in frequency” rule that requires managed devices to sync within a configurable grace period—by default, 30 days for noncompliant devices, but administrators often set a much shorter interval. When a device misses this check-in window, Intune automatically marks it noncompliant, even if all other policy settings are satisfied. On the MD-102 exam, this scenario tests your understanding of how sync timing directly impacts compliance state, and a common trap is to overlook the lastSyncDateTime field in Graph API output, focusing instead on unrelated configuration values. Remember the memory tip: “Sync or sink”—if the device hasn’t checked in recently, its compliance status will sink to noncompliant.
⚠ Common exam trap
It's easy for candidates to assume noncompliance is due to an unsupported OS version or ownership type, but the JSON explicitly shows a supported OS and no ownership-based policy, while the stale lastSyncDateTime is the clear indicator of a check-in failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The device has not synced recently; the compliance policy may require a more recent check-in.
The JSON shows the device's lastSyncDateTime is significantly older than the current time, and the complianceState is 'noncompliant'. Microsoft Intune compliance policies require devices to check in within a configurable grace period (default 30 days for noncompliant devices, but policies can enforce a shorter interval). If the device hasn't synced recently, it fails the 'Device check-in frequency' compliance rule, marking it noncompliant. Option A correctly identifies this as the most likely cause.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The device has not synced recently; the compliance policy may require a more recent check-in.
Why this is correct
Compliance policies often require devices to sync within a certain period; the last sync is March 15, which may be older than the policy threshold.
- ✗
The device is company-owned, which is noncompliant by default.
Why it's wrong here
Ownership type does not affect compliance status directly.
- ✗
The device is a userless device and cannot be compliant.
Why it's wrong here
The device has a user display name, so it is not userless.
- ✗
The device's operating system version is not supported.
Why it's wrong here
The OS version 10.0.22621.1 corresponds to Windows 11 22H2, which is supported.
Go deeper
Related to this question
Learn chapter
Introduction to Endpoint Management in Microsoft 365
Key term
Microsoft Intune
Microsoft Intune is a cloud-based service that helps organizations manage employee devices, apps, and security policies without needing to own or control the physical hardware.
Key term
Intune
Microsoft Intune is a cloud-based service that helps organizations manage their users' devices and applications, ensuring security and compliance without needing to own or control the physical hardware.
About these practice questions
One of 942 original MD-102 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on MD-102
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. You are troubleshooting a Windows 10 device that is not receiving Intune policies. The device is enrolled and shows as 'Active' in the Intune admin center. You run the Get-MgDeviceManagementManagedDevice cmdlet and the device's managementAgent is 'mdm'. Which of the following is the most likely cause of the issue?
hard- A.The device is co-managed and the workload is set to Configuration Manager.
- B.The device's enrollment certificate has expired.
- ✓ C.The device's last sync time is more than 24 hours ago.
- D.The device is retired from Intune.
Why C: The device's last sync time being more than 24 hours ago indicates that the device has not checked in with Intune within the required interval. Intune policies are delivered during a sync cycle, and if the device hasn't synced recently, it will not receive new or updated policies. The managementAgent being 'mdm' confirms the device is MDM-managed, so the sync interval is critical for policy delivery.
Variation 2. Refer to the exhibit. The JSON shows a device queried from Microsoft Graph. The device shows as compliant, but the user reports that they are unable to access corporate resources. The conditional access policy requires device compliance. What is a likely reason for the access issue?
hard- ✓ A.The device has not synced recently, so the compliance state may be outdated.
- B.The device compliance state is actually non-compliant.
- C.The device is managed by MAM instead of MDM.
- D.The device enrollment date is too recent.
Why A: The device's compliance state is determined at the time of the last check-in with Microsoft Intune. If the device has not synced recently, the compliance state shown in Microsoft Graph may be stale, and the Conditional Access policy will evaluate the last known state. Even though the device was compliant at last check-in, changes in device health, configuration, or user context since then could cause access to be denied until a fresh compliance evaluation occurs.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This MD-102 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the MD-102 exam.