What device compliance in Intune actually is
Microsoft Intune is the device management plane in Microsoft 365 for enrolling Windows, macOS, iOS and Android devices and applying policy. A compliance policy says “this device meets” or “does not meet” your minimum bar. That tick alone does little until you link it to Conditional Access: then Microsoft 365 denies access from a non-compliant device even when password and multifactor authentication are correct.
Device compliance is not magic antivirus and not a substitute for turning on multifactor authentication. It is an extra gate: the identity may enter, but only from a device you trust because it meets your baseline.
When an SME should take this seriously
Three signals keep returning in practice. You issue company laptops or phones — or you pay for employee phones and expect Outlook and Teams there. Sensitive data (customers, staff, contracts) lives in Exchange, SharePoint or OneDrive. Or you notice private phones and old home PCs without updates reach the same mailbox as the office laptop. Then “everyone has MFA” is still too open: a stolen or unencrypted device remains a hole.
Not every micro-business with three freelancers on personal MacBooks needs “require compliant device” for the whole tenant tomorrow. You do need a conscious choice: which accounts may sign in from any device, and which only from managed, compliant ones? Directors and finance often stricter; guests and light roles sometimes looser — see also guest accounts.
What to require first — and what not to over-engineer
Keep the first compliance set short enough to go live this quarter:
- disk encryption on (BitLocker on Windows, FileVault on Mac) — without it a stolen laptop is open OneDrive;
- screen lock with PIN, password or biometrics, with a reasonable timeout;
- operating system not hopelessly outdated — tied to your Windows updates and patch management;
- device enrolled in Intune (company-owned or enrolled bring-your-own-device with clear boundaries);
- no jailbreak or root where you enforce that on mobile.
What not to stack on day one: dozens of custom scripts, app locking for every app, or “approved browsers only worldwide” without an exception path. That blocks the business before the policy is ripe. Prefer three requirements everyone understands over twenty nobody follows.
Conditional Access: require compliant device
The typical MSP step: compliance policy in Intune plus a Conditional Access rule “access to Microsoft 365 cloud apps only from a compliant device” for chosen groups. Often you start report-only or with a pilot group (IT plus directors), then broaden. Break-glass accounts keep an exception — otherwise you can lock yourself out. Conditional Access without working Intune enrollment is a trap: test enrollment before you hard-block.
See our broader piece on Conditional Access in Microsoft 365: device compliance is one strong condition alongside location, risk and multifactor authentication.
How Floor ICT rolls this out — and what you decide
In the Microsoft 365 tenant we typically: set Intune licences and enrollment (Windows Autopilot or Company Portal where appropriate); a baseline compliance policy; Conditional Access “require compliant device” on agreed groups; monitoring of non-compliant devices; and an exception path for break-glass and short pilots. We explain what employees must do to become compliant (start BitLocker, set a PIN, install the app).
You still decide: whether private devices may still reach mail, which roles are hard-enforced, and how strict the update rule is. Technical toggles without ownership create angry tickets; policy without Intune stays a paper boundary.
More depth
Checklist for SME directors
1) List company laptops and phones. 2) Decide: may private devices still reach Microsoft 365? 3) Pick three baseline requirements (encryption, screen lock, updates). 4) Pilot on a small group. 5) Wire Conditional Access. 6) Arrange break-glass and a support path for non-compliant devices.
Company-owned versus bring-your-own-device
On company-owned hardware you can be stricter (full management profiles). On private devices you often choose lighter enrollment or no access to sensitive apps at all. Write that choice down — otherwise the argument starts only when someone is blocked.
Licences
Intune compliance and Conditional Access “require compliant device” need matching Microsoft 365 or Intune licences (often Business Premium or equivalent). Floor ICT checks whether your licences cover the rollout before we hard-enforce.