How to Identify Non-Compliant Devices in Microsoft 365

Even if a device is marked as non-compliant, it can still sign in to your organization and access Microsoft 365 apps unless Conditional Access policies are properly configured. Therefore, regularly auditing sign-ins from non-compliant devices strengthens device-based access controls and supports compliance with regulations like GDPR and HIPAA.

You can follow the methods given below to get all non-compliant devices sign-ins in Microsoft 365.

Track non-compliant device sign-ins using Microsoft Entra admin center

• Navigate to the Sign-in logs section in the Microsoft Entra admin center.
• Click on the desired sign-in event to open the Activity Details panel.
• Then, select the Device Info tab to check whether the signed-in device is marked as compliant or non-compliant.

Note: By default, the logs display sign-in activity from the past 24 hours. However, you can customize the date range to view activity from up to the last 30 days.

Audit user sign-ins from non-compliant devices using PowerShell

In the Entra admin center, you need to manually review each entry in the sign-in logs. These logs also include compliant device sign-ins, making it time-consuming to isolate non-compliant ones.

To simplify this, connect to Microsoft Graph PowerShell using the Connect-MgGraph cmdlet with the "AuditLog.Read.All" scope. Then, run the following cmdlet to view user sign-ins from non-compliant devices.

Get-MgAuditLogSignIn -Filter "DeviceDetail/IsCompliant eq false" | ForEach-Object {
     [PSCustomObject]@{  
           CreatedDateTime = $.CreatedDateTime;  
           UserPrincipalName = $.UserPrincipalName;  
           AppDisplayName = $.AppDisplayName;  
           ResourceDisplayName = $.ResourceDisplayName;  
           DeviceName = $.DeviceDetail.DisplayName;  
           IsManaged = $.DeviceDetail.IsManaged;  
           OS = $.DeviceDetail.OperatingSystem;  
           TrustType = $.DeviceDetail.TrustType  
     }  
} | Format-Table

The above PowerShell cmdlet retrieves each non-compliant device sign-in with details such as sign-in time, signed-in user, application name, resource name, device name, device management status, OS with version, and device trust type.

• Simply click the Alert option (🔔) in the non-compliant device sign-in report to set up notifications for any sign-in attempts from unhealthy devices across your tenant.
• Handy Tip: Use the Threshold property in alert policies to get notified whenever multiple failed sign-in attempts from non-compliant devices happen within a short time.

Intune Compliance policies provide a foundation for enforcing device security by allowing you to define rules for OS versions, password strength, and more. These policies help protect Microsoft 365 resources by restricting access from non-compliant devices. Admins can configure automated actions, such as blocking non-compliant devices, to prevent unauthorized access to Microsoft 365 resources.

Steps to create a device compliance policy in Microsoft Intune

To create a device compliance policy in Microsoft Intune, follow the below steps:

Note: You can also define additional compliance rules by uploading a discovery script and validating a JSON rules file with your custom compliance settings on supported Platforms.

By deploying compliance policies in Microsoft Intune MDM, organizations define the minimum-security standards devices must meet to be trusted. To further strengthen security, you can configure Conditional Access in Entra ID to allow access only from healthy devices.

When users work remotely or use personal devices to access organizational resources, just having a compliance policy alone isn’t enough to control access. A compliance policy only marks whether a device meets the requirements, but it doesn’t prevent a non-compliant device from signing in.

That is where device-based Conditional Access policy come in. This helps fortify your device enrollment process and ensures that only compliant devices can access your organizational resources.

Steps to enforce device compliance with Conditional Access policy in Microsoft Entra ID

While Intune policies define which devices are compliant, Conditional Access enhances this control by enforcing access restriction. Once the policy is configured, it works alongside compliance rules to prompt users to bring their devices into compliance or block access until requirements are met.

Note: To require device compliance with a Conditional Access policy, you must have a compliance policy in Microsoft Intune and at least one device marked as compliant. This prevents all users from being locked out if every device is initially marked as non-compliant.

If a device fails to meet compliance, Microsoft Intune automatically marks it as noncompliant with a schedule of zero days (0) by default. This allows Conditional Access policies to block the device immediately. However, you can configure the following actions in one or more instances to run again later if the device remains noncompliant.