Intune marks Not Compliant if device does not sign in regularly, then permanently blocks the device

[Dr_Snooze]

I'm using Intune's Conditional Access to block non-compliant devices on my O365 tenant. A problem I'm encountering is that the "Built-in Device Compliance Policy" turns Not Compliant if the device fails to log in for a long period of time. When this happens, the device gets blocked for being Not Compliant, so is unable to refresh the Built-in Device Compliance Policy that would make it compliant again. The only solution I've found is to stop enforcing CA on the user until the device is able to sign in successfully again. Then I can resume CA. This is obviously not an ideal solution. 

Am I the only one dealing with this? 

[#2]

I'll give a look.

[#3]

I was set up for "All cloud apps". I've changed it, but will have to root around here for another stale device to test it. For others who may find this thread, Intune doesn't show the entire list of cloud apps. You have to know what you're looking for and then search for it. I left the policy as "All cloud apps" with "Microsoft Intune" and "Microsoft Intune Enrollment" excluded from the policy.

The van Surksom link brings up a big spreadsheet. Lots of detail, but no discussion. Not sure if that's what you wanted. 

[#4]

Update: Excluding the Intune apps made no difference. Stale device is still blocked after reboots and forced syncs from both sides.

[#5 · Accepted solution]

@Dr_Snooze 

Hi , could you also share if there are any device cleanup rules configured ?

[#6]

Yes. They get retire command after 90 days.

[#7]

is this more or less than the "is active" setting before not getting compliant?

Skip that question :) 14 days and 90 days clean up rules.. So after 14 days you are experiencing the issue... not after 90 days?

[#8]

I do not have 14 day policy. Only the clean up policy after 90 days on inactivity to get retired.

[#9]

Ahh wait.. responding to different persons.. with 2 different kind of settings :)

so dr_snooze has set the compliance policy to 14 days and a cleanup policy...(not sure how many day?)

And amidah1 is using cleanup rules ... and after the 90 days the device isn't compliant because it has been "removed" from intune.. Am i right about that one? so before the 90 days, it still works?

[#10]

@Rudy
If ask me the retire policy is useless. After u get non compliant from 30 day without activity you don't get any command to the device because the device will no longer sync with the platform. If command change to delete to remove the registry of the device from the platform will be more effective(at least do something, clearing the useless device registers from the platform). But I wasn't the enlighten engineer who set up this way I just come along in this Frankenstein.

[#11]

I thought I had them set up, but I didn't. I just set them for a 60 day deletion.

[#12]

Hi, Good morning.. So we can rule out the "cleanup rules " :)

[#13]

@Rudy_Ooms_MVP 

Well, yesterday I would have said yes. This morning, however, the machine signed in without issue after a reboot. I found another stale device which also logged in without issue, so I guess this problem is fixed. Thank you so much!!

Out of curiosity, what made you think about cleanup rules in this context?