I posted this previously but it was marked as s.pam as some reason
Hi, we have been having issues with Compliance and Configuration policies, and Device Compliance.
We initially had a password policy of minimum 12 characters, require 1 non-alphanumeric password, lock in 15 minutes....in both Compliance Policies and Configuration policies (they matched), applied to the same user groups.
Oddly, it was showing many devices (in the office, joined to local AD but connected to Intune and BYOD joined to Intune), as non-compliant even though they definitely met the requirements....so I thought that the policies were getting confused, so I removed the password requirement from the configuration policy, and left it only in the compliance policy.
It seemed to help 1-2 devices, but many still had issues! Oddly, some devices that users were logging into their PC with their local AD credentials (but joined to Intune), and their local AD passwords were less that 12 characters, were being marked as compliant!
Some BYOD devices who definitely meet the requirements, are being marked as non-compliant because "password is too short". So I thought maybe ALL accounts on the PC (local PC accounts, etc.) need to meet the requirements, so I changed the password to match the requirements above, but still no luck! (Side note...do all accounts on the PC have to meet the requirements?)
I changed the policy to 8 characters instead of 12, and now all of a sudden....many of the devices are now being marked as compliant!
This is very frustrating and support hasn't been of much help. Note that we are using Conditional Access and Trusted locations, if that helps (I am assuming that since the office PCs that are connected to local AD but connected to Intune, are inside trusted locations....it doesn't matter if it is compliant or not, it will be able to access resources?). MDM is also enabled to all users and MAM is turned off.
Any help on these issues would be great, thanks
