Incorrect compliancy issue

[RonaldvdMeer]

We sometme have an issue with users where the signin logs show that they have in incompliant device which causing issue with logging in applications because of the conditional access policies.

When we check the device compliance al is green and compliant. We have no clue why the signin logs show incompliancy and so we do not know where to start to check what the cause of this issue is.

[#2]

@RonaldvdMeer 

Hi,

Did you check it out on the device itself in the company portal app?

ANd did you expand the compliance settings in the device in Intune to be 100% sure its not blocking. SOmetimes it looks green... but when opening the device properties and clicking on device compliance and clicking on each policy to unfold it. It could show you some more information

And maybe this blog helps you to get a good understanding about compliant devices and ca
https://call4cloud.nl/2021/08/the-death-of-compliance/

[#3]

Thx. When clicking on each policy all is green. I haven't been able to let the affected user to check the device in the company portal yet. So i do not yet know what that will bring. I will look in to your blog. I have seen this blog yesteraday being post.

[#4]

Another observation had that the signin log of one particular user showed that if he used Chrome as browser Compliant and Managed stated Yes. When using Edge (chromium based) Compliant en Managed stated No.

[#5]

When using chrome normally you would need the account extension to pass/report the compliance status/prt otherwise they report as non compliant. Does chrome has the account extension active, as it is compliant etc?

[#6]

Yes it has the extension. But that doesn't explain to me why Chrome shows compliant and Edge doesn't

[#7]

To be sure... is edge logged in with the same azure ad account?

The explanation behind it

Microsoft Edge has native support for PRT-based SSO, and you don't need an extension. On Windows 10 RS3 and above, if a user is signed into their browser profile, they will get SSO with the PRT mechanism to websites that support PRT-based SSO.

[#8]

Yes same azure ad account

[#9]

No weird errors in the AAD event log or/and dsregcmd /status?

[#10]

I will get the log from the users device via intune. dsregcmd /status will check next week

[#11]

I got the dsregcmd status log from the downloaded diagnostics
This is what the User state en SSO state says. Not the way it should compare to a device with no issues. Next question is what is the best way to repair it.

+----------------------------------------------------------------------+
| User State |
+----------------------------------------------------------------------+
NgcSet : NO
WorkplaceJoined : NO
WamDefaultSet : ERROR
+----------------------------------------------------------------------+
| SSO State |
+----------------------------------------------------------------------+
AzureAdPrt : NO
AzureAdPrtAuthority :
EnterprisePrt : NO
EnterprisePrtAuthority :

[#12]

Is that report from the same user? As the prt doesnt show up when you run it as a local user… the azureadprt doesnt look good

[#13]

thats the report of the user that had no trouble using Google chrome as browser but Edge was not working for him.

[#14]

The device was is perfect health until the user reported the issue

[#15]

Also the NGC Prereq check says this.
I am starting to wonder if the particular user has another work or school account present
+----------------------------------------------------------------------+
| Ngc Prerequisite Check |
+----------------------------------------------------------------------+
IsDeviceJoined : YES
IsUserAzureAD : NO
PolicyEnabled : NO
PostLogonEnabled : YES
DeviceEligible : YES
SessionIsNotRemote : YES
CertEnrollment : none
PreReqResult : WillNotProvision

[#16]

Looking at the outputs you showed....I have the idea I am looking at information from a non azure ad joined device...?

[#17]

Yes but is joined. All our laptops are. They are All provisioned with Windows autopilot. This device was working perfect until last monday.

[#18]

Its hard to tell from a “distance” but i would start with looking at the aad and modern deployment eventlogs… it looks like something is reallt broken in the device. Is the intune mdm certificate still valid ? (I am mentioning this in one of my blogs)