Implement compliance policies using Intune

Question 1

What are the 2 areas in Intune regarding compliance policies

Answer 1

Compliance policy settings
&
device compliance policy

Question 2

What are compliance policy settings?

Answer 2

• tenant wide configuration
• built in compliance policy that every device receives
• establishes how compliance policy works in intune environment: spcifically, how to treat a device without explicit compliance policy assigned

Question 3

What is a device compliance policy?

Answer 3

discrete set of **platform-specific rules and settings **
deployed to group of users or devices

Question 4

What are the 2 prerequisites to deploy a compliance policy (setting or device)?

Answer 4

• Entra ID P1 or P2
• Intune license for each user/device

Question 5

In intunes, where do you go to manage Compliance policy settings?

Answer 5

In Endpoint security > Device compliance > Compliance policies > Compliance policy settings

Question 6

What are the 2 settings you can manage in compliance policy settings?

Answer 6

• Mark devices with no compliance policy assigned as : Compliant (default) / not compliant
• compliance status validity period : period on which devices must successfully report on all their received compliance policy. After that, marked as not compliant

Question 7

Where can you also set up or review compliance settings or the device compliance policies ?

Answer 7

In Devices > Under Manage devices > compliance

Question 8

What is the key rule when you have several platform in your organization and you want to implement device compliance policies?

Answer 8

1 separate policy for each platform
Each device platform is different, so device compliance settings are different

Question 9

List the 7 steps to create a device compliance policy

Answer 9

Step 1 : Go to Devices > Under Manage devices, select Compliance > Create policy.

Step 2 : Select a Platform for this policy from the following options:
Then select Create to open the configuration page.

Step 3 : On the Basics tab, enter a Name + Description for the policy.

Step 4 : On the Compliance settings tab, expand the available categories, and configure settings for your policy.
Optionally, you can add custom settings for Linux - Uuntu and Windows 10 & later if you already uploaded a detection script and have ready a JSON file that defines the settings

Step 5 : On the Actions for noncompliance tab, select a sequence of actions to apply automatically to devices that don’t meet this compliance policy.

Step 6 : On the Assignments tab, assign the policy to your groups. For Linux, you can choose only device groups

Step 7 : Review + create

Question 10

On which platform can you create a device compliance policy?

Answer 10

Android device administrator
Android (AOSP)
Android Enterprise
iOS/iPadOS
Linux - (Ubuntu Desktop, version 20.04 LTS and 22.04 LTS, RedHat Enterprise Linux 8, or RedHat Enterprise Linux 9)
macOS
Windows 10 and later
Windows 8.1 and later

Question 11

What is resulting compliance status?

Answer 11

If a device has multiple compliance policies, and the device has different compliance statuses for two or more of the assigned compliance policies, then a single resulting compliance status is assigned.
This assignment is based on a conceptual severity level assigned to each compliance status.
When a device has multiple compliance policies, then the highest severity level of all the policies is assigned to that device.

Question 12

What is the default action for noncompliance in device compliance policies?

Answer 12

Mark device noncompliant with a schedule of zero days

This means Intune immediately marks the device as noncompliant when it detects a noncompliance issue.

Question 13

What happens when a device is marked as noncompliant?

Answer 13

Microsoft Entra Conditional Access can block the device

This action prevents access to resources until compliance is achieved.

Question 14

What is the purpose of configuring Actions for noncompliance?

Answer 14

Gain flexibility to decide actions for noncompliant devices and their timing

Question 15

What can an organization choose regarding the blocking of a noncompliant device?

Answer 15

Not block the device immediately and provide a grace period

This gives users time to become compliant before any actions are taken.

Question 16

What determines when an action for noncompliance takes effect?

Answer 16

A schedule defined in days after the device is marked as noncompliant

Organizations can set specific timelines for compliance actions.

Question 17

Can multiple instances of an action be configured in a policy?

Answer 17

Yes

This allows the action to run again at a later scheduled time if the device remains noncompliant.

Question 18

Are all actions available for all platforms?

Answer 18

No

Availability of actions may vary depending on the platform being used.

Question 19

What is the default action taken for noncompliant devices?

Answer 19

Mark device non-compliant immediately.

This default action has a schedule of zero (0) days.

Question 20

What are the 4 available actions for non compliance?

Answer 20

• Mark device non-compliant
• Send email to end user
• Remotely lock the noncompliant device
• Send push notification to end user

Question 21

What action sends an email notification to the user regarding noncompliance?

Answer 21

Send email to end user.

This action includes details about the noncompliant device in the email notification.

Question 22

What must be created before assigning a notification message template for email notifications?

Answer 22

A notification message template.

The template can be customized with locale, subject, message body, and company information.

Question 23

What happens if no email address is defined in the user’s profile?

Answer 23

Intune doesn’t send a notification email.

Intune uses the email address defined in the end user’s profile.

Question 24

What must the user do when the noncompliant device has been remotely locked bbecause of noncompliant device action?

Answer 24

The user must enter a PIN or password to unlock the device.

Question 25

Which 5 platforms support the action to remotely lock a noncompliant device?

Answer 25

* Android device administrator * Android (AOSP) * Android Enterprise (Fully Managed, Dedicated, Corporate-Owned Work Profile, Personally Owned Work Profile, kiosk devices) * iOS/iPadOS * macOS | Not windows, not Linux

Question 26

What occurs when a device is added to the retire list in Intune?

Answer 26

It is marked as a noncompliant device but not retired until an admin initiates retirement. ## Footnote Retirement removes all company data and the device from Intune management.

Question 27

What 6 platforms support the action to add a device to the retire list?

Answer 27

* Android device administrator * Android (AOSP) * Android Enterprise (Fully Managed, Dedicated, Corporate-Owned Work Profile, Personally Owned Work Profile) * iOS/iPadOS * macOS * Windows 10/11 ## Footnote Devices are not retired until explicitly initiated by an administrator.

Question 28

What options are available for managing the retire state of devices?

Answer 28

* Retire all devices * Clear all devices retire state * Clear selected devices retire state ## Footnote Clearing the retire state removes the device from the retire list until added again.

Question 29

What action sends a push notification about noncompliance to a device?

Answer 29

Send push notification to end user. ## Footnote This notification is sent the first time a device checks in with Intune and is found noncompliant.

Question 30

What 3 platforms support sending a push notification about noncompliance?

Answer 30

* Android device administrator * Android Enterprise (Fully Managed, Dedicated, Corporate-Owned Work Profile, Personally Owned Work Profile) * iOS/iPadOS ## Footnote The notification opens the Company Portal app or Intune app to provide details.

Question 31

True or False: The message details about noncompliance in push notifications can be customized.

Answer 31

False. ## Footnote The details are generated by Intune and cannot be altered.

Question 32

If you want to monitor your devices' compliance where do you go?

Answer 32

In Intune, **Devices** > **Compliance**, and then select the **Monitor** tab.

Question 33

What are the 4 compliance status categories you can find in Devices > Compliance > Monitor?

Answer 33

* Compliant * In-grace period * Not evaluated * Not compliant

Question 34

What does it mean when a device is compliant?

Answer 34

The device successfully applied one or more device compliance policy settings. ## Footnote Compliance indicates that the device meets the required settings as defined by the policy.

Question 35

What is an in-grace period for a device?

Answer 35

The device is targeted with one or more device compliance policy settings but isn't yet compliant to all of them. ## Footnote This status often arises from users not applying compliant configurations, such as failing to meet password complexity requirements.

Question 36

What does 'not evaluated' mean for a device?

Answer 36

The initial state for newly enrolled devices that haven't been checked for compliance. ## Footnote This can also occur if devices aren't assigned a compliance policy, haven't checked in since the policy was last updated, or lack user association.

Question 37

What could cause a device to be in a 'not evaluated' state?

Answer 37

Possible reasons include: * Devices not assigned a compliance policy * Devices that haven't checked in since the last policy update * Devices not associated to a specific user ## Footnote Examples of devices not associated with a user include iOS/iPadOS devices from Apple's Device Enrollment Program and Android kiosk devices.

Question 38

What does it mean when a device is 'not compliant'?

Answer 38

The device failed to apply one or more device compliance policy settings, or the user hasn't complied with the policies. ## Footnote Noncompliance indicates a failure to meet the established security or configuration requirements.

Question 39

By default, when you select a policy, what does Intune dispaly ?

Answer 39

Intune opens the Monitor tab for that policy, where Intune displays: * **Device status** - A simple bar chart that identifies the basic compliance status for devices that receive this policy. * **View report** - A button you can select that opens the device status report where you can view deeper details about device compliance to this policy. * **Per-setting status** - A tile you can select that opens the per-setting status report for this policy.

Question 40

Which other compliance reports are availabble in Devices > Monitor ?

Answer 40

* Noncompliant devices * Policy noncompliance

Question 41

How Intune resolves policy conflicts ?

Answer 41

can occur when multiple Intune policies are applied to a device * **between settings from an Intune configuration policy and a compliance policy**, the **settings in the compliance policy take precedence over the settings in the configuration policy**. * If you have deployed **multiple** compliance policies, Intune uses the **most secure of these policies**.