Support tip: Understanding Microsoft Intune compliance policies reporting SyncML(500) errors

Yea, MS markets the intune compliance feature as a near-real time technology but in practice it is anything but.

Last year we did significant laptop deployment for a security conscious customer... the laptops were pre-built at the warehouse and then turned off and shipped to the customer (often offline for 7 days or more).  When users started up their laptops they couldn't access any m365 resources because their devices were non-compliant (and conditional access required compliant devices).  AV and firewall were on, but this SyncML(500) error was causing false negatives for the firewall/av/bitlocker checks.  On average, it took users a couple hours of reboots and manual syncs to get the devices to show as compliant.  This behavior was consistent for all 1000 devices over the course of the deployment.

MS support engineers were unable to explain/resolve the issue and finally advised that a grace period of 24+ hours might be needed to make things work!

I no longer recommend customers use the intune compliance feature.