Unassigned devices are Not compliant by default in Intune

​

What this check verifies

Intune has a built-in Device Compliance Policy that governs how devices without an explicit compliance policy are treated. When the default behavior marks those devices as Compliant, unmanaged devices can be treated as compliant and gain access to corporate resources. This check verifies the default is set to Not compliant (secureByDefault = true).

​

Risk

If the built-in policy marks devices without a compliance policy as Compliant, those devices can bypass Conditional Access policies requiring device compliance, granting unauthorized access to corporate resources from unmanaged or non-compliant endpoints.

​

Recommendation

Set the built-in Device Compliance Policy default so devices with no compliance policy assigned are marked as Not compliant.

​

Remediation

Dashboard steps

1. Sign in to the Microsoft Intune admin center (intune.microsoft.com)
2. Go to Devices > Compliance
3. Select Compliance policy settings
4. Set ‘Mark devices with no compliance policy assigned as’ to ‘Not compliant’
5. Save the settings

​

References

• https://learn.microsoft.com/en-us/graph/api/resources/intune-deviceconfig-devicemanagementsettings?view=graph-rest-1.0

​

Where this check fires

This check runs on every scheduled scan against your Microsoft 365 account. Findings appear at Cloud Security → Findings filterable by Check ID = intune_device_compliance_policy_unassigned_devices_not_compliant_by_default. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Microsoft 365 checks