Device compliance
Device compliance is an assessment of a device's reported state against configured requirements, such as an operating-system version or encryption setting. Its meaning depends on the policy and management system performing the assessment.
Compliant with which requirements?
Intune evaluates devices against platform-specific rules, such as a minimum operating-system version. Entra Conditional Access can use the result to require a compliant device for access. The assessment and the access requirement are separate configurations.
A green status is useful only when you know what produced it. Intune has a tenant-wide setting for devices with no assigned compliance policy. It can classify them as compliant or noncompliant, so inspect that setting before assuming a green device passed your intended checks.
The result has a lifetime
Devices must report their compliance status within the configured validity period. A device that stops reporting can become noncompliant. Check when the result was reported, which requirements applied, and how the tenant handles missing reports.
For an access investigation, match the device ID to the sign-in and inspect the applicable Conditional Access policy. An endpoint can have a compliance result without an application requiring that result for access.
Registration identifies the device’s directory relationship; compliance evaluates its reported state. Neither is a guarantee that the endpoint is free of malware.