Hybrid Azure AD joined Devices WITHOUT Intune show up as Non Compliant

[ErikVet]

Hello,

We do not use Intune for Windows at the moment. Everything is blocked e.g. Enrollment Polices, not Autopilot etc. 

At the moment we are seeing some devices in AAD under Devices that show up with a Compliance Status No but others not. 

For example a valid device: 

and a Device that with the Compliance Status 

We do not know how this happens. We do have Compliance Polices for testing AzureAD joined devices but only via staged rollout (groups). 

How is it possible that some devices get a compliance status without Intune ?

Many Greetings and thanks for any hint. 
Erik 

[#2]

Hi @ErikVet! As your Azure AD shows these devices as "MDM: None", we would indeed expect "Compliant: N/A".

Were these devices ever enrolled in Intune (accidentally, or for testing)? If so, check if there's a "Manage" button in the Azure AD device page. If there is, there's will be a Managed Device object (Intune) linked to the Azure AD Device object, which is probably marked non-compliant.

[#3]

@NielsScheffers 

Thx for you reply.

Sadly not .. their not managed and the do not show in Intune/Enpoint under

non compliant devices. 

Devices (multiple) no scheme recognizable :(

Of course CA Policy are in place and are applied to those devices. 

[#4]

How did you configured the default compliance policy.... "mark devices without compliance policy" compliant or not compliant.

Als wondering about the mdm scope etc as described here
https://call4cloud.nl/2021/08/the-battle-between-aadj-and-aadr/ (i know its aadr/aadj... but )

[#5]

@Rudy_Ooms_MVP  .. thanks for you comments 

Default Compliance is configured as "not compliant" but the effected "Not Compliant Devices" without and MDM Scope (AADHJ devices) under AzureAD Devices do not show up in Endpoint Mgr.

But changing this would also effect not only windows devices right ... all the mobile devices too ... 

Scope for Windows Enrollment is set to "Some" but is 100% sure that none of the affected devices/user where in that group. 

[#6]

Mmm pretty weird... as you should normally say that when a device isn't enrolled into intune it doesn't have the possibility to get a compliant state.

Could you find out the reason why its not compliant? ( I assume the build in ones) or?

[#7]

I am having exactly same issue. some devices shows NA for compliant status and other devices shows NO. we have nothing configured in Intune at this time to manage any devices.

[#8]

@Rudy_Ooms_MVP 

Indeed that is pretty weird. It looks like only devices which where "setup" in last couple of months. But also older ones are affected. 

As they show not in intune it is just guessing what compliance rules trigger it. Is this somehow possible of the Graph API but I have look for that in detail. 

Maybe some Intune/Device/AzureAD MVP can ask the product team  .. I do not have those connections . Or even MS is reading this and can give some hints as this is definitely not normal. 

Thx

Erik 

[#9]

@Ketzpatel 

 .. This is pretty weird but We are also a little bit relieved as we are not the only one. 

Do you have find out why this is happening ? 

[#10]

Okay but as you configured nothing in Intune and you are enrolling those devices into intune…? you also have no compliance policies configured etc so… one of the build in compliance policies is: has a compliance policy assigned… guess what happens when it doesnt gets or has one :)

[#11]

To do so i need way more information :)… as example those devices that havent a mdm set… the person who enrolled it… had that user a intune license… how does the dsregcmd /status output looks like…

Feel free to gather some logs with this powershell command

wget https://aka.ms/intuneps1 -outfile IntuneODCStandAlone.ps1

powerShell -ExecutionPolicy Bypass -File .\IntuneODCStandAlone.ps1

[#12]

So we have AAD conditional access policy configured to allow only hybrid AAD joined (Win10) devices or compliant devices(iOS & Android) using compliance partner configured in Intune with AirWatch. no Win devices are enrolled or show up in Intune - Device blade. These devices are only visible in AAD - All Devices blade. there are about 4000 devices hybrid joined and only half of the devices show Compliant = NO other shows compliant = NA.

[#13]

Are you 100% sure those devices got targetted with the gpo and successfully enrolled those devices into Intune? (registry settings configured



Did you also looked at the event logs mentioned in this blog?

https://docs.microsoft.com/en-us/windows/client-management/mdm/enroll-a-windows-10-device-automatica...
Yo

[#14]

@Rudy_Ooms_MVP 

We have GPO configured to push these devices as hybrid joined in Azure so they can pass the conditional access. there is nothing else configured to manage these devices in Intune. All users are currently licensed to Intune and other services under E5.

[#15]

Those devices that show n/a thats of course obvious... but those "NO" are weird as normally you need intune to deliver that "judgment" :)

https://docs.microsoft.com/en-us/answers/questions/909847/non-compliance-of-devices-in-azure-ad-with...

[#16]

@Rudy_Ooms_MVP 

@Ketzpatel 

I guess I have found something that may have something to do with this ... 

MS changed the Device restriction to bei more granular (Could not find since when). Before you have device platform polices into one Policy as seen here in an old screenshot.

If i look now into the Intune device restriction portal we have different possibilities per platform (e.g Android, Windows)

If i look in our tenant i can see the restriction policy  for windows, mac and ios with a weird behavior. The groups are not displayed correctly as they should. Maybe here is a issue and it happend when MS rollout out the new restriction policys - from general to platform specific. 

Only Android works correctly 


Greetings
Erik 

[#17]

We just started seeing this today, which then broke some of our Conditional Access!

Did you ever figure it out?

[#18]

Any updates?

[#19]

@ErikVet 

Just curious if you ever figured out what was going on. We are seeing the same thing and I have opened a ticket with MS but haven't heard back yet. I did notice that this only happens in our environment for those Windows 10 workstations that hybrid join via federation (ADFS). If the ADFS process fails and the devices goes through the managed hybrid join (azure ad connect) then the compliance field is left at N/A. When going through ADFS the registration add sets iscompliant to FALSE.

[#20]

if the device is a hybrid AD join and without any owner it will show up as non compliant even if its not enrolled to Intune .