Back to Checks
m365

Built-in Device Compliance Policy marks devices without an assigned compliance policy as Not compliant by default

intune_device_compliance_policy_unassigned_devices_not_compliant_by_default
Service: intuneSeverity: high
OfficialBuilt-inVerified
Categories:trust-boundaries
Resource Type:NotDefined

Intune has a built-in Device Compliance Policy that governs how devices without an explicit compliance policy are treated. When the default behavior marks those devices as Compliant, unmanaged devices can be treated as compliant and gain access to corporate resources. This check verifies the default is set to Not compliant (secureByDefault = true).

Prowler logoProwlerprowler-provider-m365

Risk

If the built-in policy marks devices without a compliance policy as Compliant, those devices can bypass Conditional Access policies requiring device compliance, granting unauthorized access to corporate resources from unmanaged or non-compliant endpoints.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler m365 --checks intune_device_compliance_policy_unassigned_devices_not_compliant_by_default

Recommendation

Set the built-in Device Compliance Policy default so devices with no compliance policy assigned are marked as Not compliant.

Remediation

Other

1Sign in to the Microsoft Intune admin center (intune.microsoft.com)
2Go to Devices > Compliance
3Select Compliance policy settings
4Set 'Mark devices with no compliance policy assigned as' to 'Not compliant'
5Save the settings

Check Code

from prowler.lib.check.models import Check, CheckReportM365
from prowler.providers.m365.services.intune.intune_client import intune_client


class intune_device_compliance_policy_unassigned_devices_not_compliant_by_default(
    Check
):
    """Ensure the built-in Device Compliance Policy marks unassigned devices as Not compliant by default."""

    def execute(self) -> list[CheckReportM365]:
        findings = []

        report = CheckReportM365(
            metadata=self.metadata(),
            resource=intune_client.settings or {},
            resource_name="Intune Device Compliance Settings",
            resource_id="deviceManagement/settings",
        )

        verification_error = getattr(intune_client, "verification_error", None)
        settings = getattr(intune_client, "settings", None)
        secure_by_default = getattr(settings, "secure_by_default", None)

        if verification_error:
            report.status = "MANUAL"
            report.status_extended = (
                "Intune built-in Device Compliance Policy could not be verified. "
                f"{verification_error}"
            )
        elif settings is None or secure_by_default is None:
            report.status = "MANUAL"
            report.status_extended = (
                "Intune built-in Device Compliance Policy could not be verified "
                "because Microsoft Graph did not return the secure-by-default "
                "compliance setting."
            )
        elif secure_by_default is True:
            report.status = "PASS"
            report.status_extended = (
                "Intune built-in Device Compliance Policy marks devices "
                "with no compliance policy assigned as Not compliant."
            )
        else:
            report.status = "FAIL"
            report.status_extended = (
                "Intune built-in Device Compliance Policy marks devices "
                "with no compliance policy assigned as Compliant. "
                "Change the default to Not compliant in Intune settings."
            )

        findings.append(report)
        return findings

References