Microsoft Intune Compliance Policies: Device Health Enforcement for Berlin Businesses

Microsoft Intune compliance policies define the minimum security requirements that a device must meet to be considered healthy — including operating system version requirements, password complexity, encryption status, antivirus and firewall state, jailbreak/root detection, and Microsoft Defender for Endpoint health signals. For Berlin small businesses, compliance policies are the foundation of a device-based Conditional Access architecture: only devices that pass compliance checks are permitted to access corporate resources, regardless of whether correct credentials are provided. This approach eliminates the risk of credential theft enabling access from an unmanaged or compromised device.

How Compliance Policies Work

Intune evaluates device compliance against the assigned policy and reports the status back to Entra ID as a device attribute. Each device gets a compliance state of Compliant, Not Compliant, Not Evaluated (no policy assigned), or Grace Period (policy assigned but deadline not yet reached). Conditional Access policies can then require the device compliance state to be “Compliant” before granting access to applications — a user with valid MFA can still be blocked if their device has not checked in, is missing patches, or has encryption disabled.

Compliance policy evaluation happens every time a device checks in with Intune, and the compliance state is pushed to Entra ID in near real time. If a device falls out of compliance — for example, because an antivirus update failed or the device was jailbroken — its Entra ID compliance attribute changes to non-compliant, and subsequent Conditional Access evaluations will block access until the device remediates. The compliance status is visible in the Intune admin center per device, allowing IT to identify and prioritize remediation for non-compliant devices.

Key Compliance Requirements for Small Businesses

A well-configured Intune compliance policy for Berlin SMBs typically enforces: minimum Windows 10 22H2 or Windows 11 OS version (blocking devices running EOL builds), BitLocker encryption enabled, Windows Defender Firewall on for all network profiles, Microsoft Defender Antivirus reporting as active, and a device password/PIN required. For organizations with Defender for Endpoint integration, the policy can also require a maximum device risk score — blocking devices that MDE has flagged as high risk from accessing corporate data even if all other compliance checks pass.

Grace Periods and Remediation Notifications

Compliance policies can include a grace period — a number of days after a device falls out of compliance before the non-compliant state is enforced — allowing users time to remediate before access is blocked. During the grace period, Intune sends notification emails to the device user and optionally escalates to the manager after a configurable interval. For initial compliance policy rollout, a grace period of 7-14 days is recommended to identify and remediate devices that have been non-compliant without the device owners knowing, before the policy begins blocking access.

Platform-Specific Policies: Windows, macOS, iOS, Android

Intune compliance policies are platform-specific — separate policies exist for Windows, macOS, iOS, iPadOS, and Android. Each platform has different compliance settings reflecting the capabilities of the operating system. macOS policies can enforce FileVault encryption, Gatekeeper settings, and system integrity protection. iOS/Android policies can enforce encryption, screen lock requirements, and OS version minimums, and for Android Enterprise can additionally check that the device is enrolled in the work profile mode rather than using personal device mode for corporate access.

Need to enforce device health requirements before allowing corporate data access in your Berlin organization? IT Experts Berlin designs Intune compliance policies for all device platforms in scope, integrates compliance state with Conditional Access, and configures graduated notification and remediation workflows for non-compliant devices.