Intune marks Not Compliant if device does not sign in regularly, then permanently blocks the device

[Dr_Snooze]

I'm using Intune's Conditional Access to block non-compliant devices on my O365 tenant. A problem I'm encountering is that the "Built-in Device Compliance Policy" turns Not Compliant if the device fails to log in for a long period of time. When this happens, the device gets blocked for being Not Compliant, so is unable to refresh the Built-in Device Compliance Policy that would make it compliant again. The only solution I've found is to stop enforcing CA on the user until the device is able to sign in successfully again. Then I can resume CA. This is obviously not an ideal solution. 

Am I the only one dealing with this? 

[#2]

Hi

Good morning could you show us how you configured the Compliance status validity period (days): and the mark devices with no compliance policy as? non compliant i guess?

But normally when the device isn't active for the days you configured in the validity period the device gets non compliant indeed.. but normally when the user just logs in, it will report back its status to intune....it should be weird that conditional access breaks the remediation :)

What happens when the user logs in and does a manually sync or refresh from the company portal?

[#3]

@Rudy_Ooms_MVP 

Thanks for responding. Here are my settings:

 

I'm not able to do manual syncs because the device is logged out and you have to log back in before you can do any kind of sync, which gets blocked by CA. The only way I can get the device functioning again is to disable CA and log in, then re-enable. I'm not even sure I'd be able to completely unenroll the device and re-enroll. CA's blocking is quite belligerent. 

I have only encountered this a couple times so far (of course, I'm only managing a handful of devices at this point), so I'm not sure if there's something else going on in addition. 

Thanks again.

[#4]

Hi, good morning

Really curious what error you are receiving when you are trying to log in, could you share that information? and what conditional access rule you are turning off to allow it again.
And maybe the error in the sign in log? As I am also writing a blog about this topic :)... it could be very useful in to troubleshooting what happened and of course how to solve it

Thanx

[#5]

Hi I found this error too, actually is no error only that when u try to check device compliance manually is failing and request to retry. Doesn't matter how many times you retry will not work if mark as non compliant is not disabled. Once you disable that is checking ok and u have to enable it again. As the original poster said is not a solution in a big environment when any change needs approvals and time windows for changes.

Thanx

[#6]

Ahh okay I was assuming there wasnt a possibility to login.. but it fails to check the device compliance... (as I cant yet test it... need to wait 12 hours or so before the 1 day not active will expire) what happens when you sync the device from the company portal... or the device itself?
COuld you take a look at the event logs (aad ) what it is telling you.

[#7]

As I like to reply with the logs, I don't have access at the device with the issue(user is on another continent) and is not a tech guy so I could not rely on him to retrieve the logs. And as the current policy is in place for 60 days off before marked as non compliant, I 'am sure I'll not wait that long to get the logs.

[#8]

On the Intune side there is no log of the device trying to sync. I think is because is not getting to sync once is flagged.

[#9]

Hope to test it tomorrow...

[#10]

I had it happen just now on a test device that I haven't used in a while. Here is the error message when you try to log in.

Azure AD reports this sign-in error.

Forcing manual syncs from the device and/or the portal make no change.

To correct, I don't actually disable the CA policy. I remove the user from the Group to which the policy is applied. It's less disruptive, but still not an acceptable workaround. 

When you say, "event logs (aad)," can you be more specific? I've tried looking at the Intune device logs. There are a zillion of them and I get a headache the moment I open even one. 

Thanks,

[#11]

I will take a look at my own device tomorrow hopefully the last check in has expired so i can test it

[#12]

Hi,

Just to be 100% we having the same sa rule setup for requiring a compliant device... which apps are you targeting ? all apps or office 365 apps ?

[#13]

My environment is basically based on Office apps but we have some outside Microsoft environment. So is for all company apps (office and non office)

[#14]

Hi,

So you targetted "All cloud Apps? No exclusions ?

Like shown below, is the ca rule targgette dat all cloud apps or multiple selected apps? 

[#15]

Yes.

[#16]

Just wondering... but what happens when you exclude the "Microsoft Intune" and the "Microsoft Intune enrollment" from the ca?

Like mentioned in this blog

November | 2021 | The Cloud Technologist

[#17]

Can't say as the editing the policies is a change process that need approvals in my actual role. The motivation for me is finding a long term viable solution. As a workaround the reenrollment is good enough.

[#18]

But to find a long term viable solution, you will need to first know what caused it?

I will setup a demo tenant for this and will try to see if that is causing the issue you are experiencing.

[#19]

I know but with such decentralized management in the actual company, and with my role that don't have the tools at the moment available for troubleshooting deeper this kind of issues I try consulting others that stepped in this issue.

[#20]

Hi,

Maybe its worth looking into for the future
Kenneth van Surksom has a nice howto... and he is also using "Office 365" and not all cloud apps

https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fraw.githubusercontent.com%2Fkennethv...