AdminPackStudio

Posted on Oct 13

Intune Compliance: Not Applicable, Is Active, Minimum OS

#microsoft #intune #sysadmin #windows

The ticket usually starts with a screenshot. Either a compliance report shows a pile of devices you can't explain, or a user is blocked because their device is "not compliant" and nobody changed anything. Before you edit a policy, you can usually work out what's going on by reading the reports, the device and the tenant-wide settings. Nothing in this post changes a device or a policy.

TL;DR

Policy and setting reports have more than two buckets: Compliant, Noncompliant, Not evaluated, Not applicable and Conflict. Read each one on its own terms before acting.
A device can fail the built-in default compliance policy even when your own policies pass. "Is active" means the device has to keep checking in with Intune.
Minimum OS version on Windows compares the full major.minor.build.revision value. Take the number from ver on a real device instead of guessing it.
Reports reflect the device's last check-in, so a fresh policy change can look "wrong" for a while.

Which compliance report are you actually looking at?

Intune has a few compliance views, and they answer different questions:

View	Where (Intune admin center)	What it tells you
Compliance dashboard	Devices > Compliance, Monitor tab	Overall device compliance status and devices without a compliance policy
A single policy	Devices > Compliance > select the policy	Device status for that policy, plus View report and Per-setting status
Organizational reports	Reports > Device compliance, Reports tab	Noncompliant devices and trends across policies and settings

One detail catches people out. In a single policy's report, Policy compliance status only describes compliance with that policy. A device can be compliant there and still be noncompliant overall because of a different policy. If the numbers don't add up, check whether you're comparing a per-policy view with the device's overall state.

What do "Not evaluated" and "Not applicable" mean?

The policy compliance and setting compliance reports list counts for Compliant, Noncompliant, Not evaluated, Not applicable and Conflict devices. You can select an entry to drill into the devices behind each count.

Not evaluated has a documented meaning. It's the initial state for newly enrolled devices. You'll also see it for:

devices that aren't assigned a compliance policy and have no trigger to check compliance
devices that haven't checked in since the policy was last updated
devices without a specific user: Apple DEP devices without user affinity, Android Enterprise dedicated devices, and devices enrolled with a device enrollment manager (DEM) account

Not applicable is its own bucket, separate from Noncompliant. Don't treat it as a failure count. Drill into the setting, see which devices sit there, and compare their platform and assignment with what the policy targets before you change anything.

Why is a device "not compliant" when it passes my policy?

Check the built-in default compliance policy. Intune evaluates it alongside yours. A device is noncompliant if any of these is false:

The device has a compliance policy assigned. At least one applicable compliance policy with an applicable setting has to be assigned.
The device is active. It needs to stay in contact with Intune, which means powered on with an internet connection. This is the "Is active" line people see.
The enrolled user exists. The user on the device exists and has a valid Intune license.

Two tenant-wide settings drive this. Find them under Endpoint security > Device compliance > Compliance policy settings:

Setting	Default	Why it matters
Mark devices with no compliance policy assigned as	Compliant	Microsoft recommends Not compliant, so unassigned devices show up instead of quietly passing
Compliance status validity period (days)	30	A device that doesn't report on all its compliance policies within this window counts as noncompliant. You can set 1 to 120 days

So for "Is active", the device usually isn't misconfigured. It's simply been offline, powered off or unused for longer than the validity period. Look at the device's last check-in time before you look at the policy.

Also note that reports show the compliance state of the last user on the device. On a shared device you may be looking at someone else's result. For device-targeted policies, System account appears as the UPN if nobody was signed in during the last check.

Why does Minimum OS version mark a patched device noncompliant?

For Windows compliance policies, Minimum OS version takes a value in major.minor.build.revision format. A device with an earlier version than the one you enter is reported as noncompliant.

The most common cause is a value that doesn't match how Windows reports its version. Microsoft's guidance is to read it off a device. Open a command prompt and run:

ver

It returns something like Microsoft Windows [Version 10.0.17134.1]. Use that format, including the right version prefix for the release, as described in the Windows release information Microsoft links from the policy settings page.

Things to check, read-only:

What did you type? Compare the policy value with ver output from a device you know is current.
Did the device check in? Reports refresh when the device checks in, so a device that has just installed an update can still show its old state.
Do you need more than one floor? Windows policies also have Valid operating system builds, which takes minimum and maximum ranges. It's built for enforcing patch levels across several Windows releases, where a single Minimum OS version doesn't fit.

If you also run update rings, your OS floor has to stay behind what your rings actually deliver. Our update rings post explains why Minimum OS compliance tends to fail first.

Why did the report change without a policy change?

Intune evaluates compliance continuously, but reports update when the device checks in. Expect:

Pending-looking states until the device checks in and reports.
Duplicate rows for one device, for example separate user and system records.
Summary views and device lists out of step for a while.
Settings in Error. When a setting returns Error, the device keeps its existing compliance state for up to seven days. If it's still in Error after that, the device becomes Not compliant, or In grace period if the policy has a grace period.

The Error rule matters most for helpdesk. A device can lose access to Conditional Access-protected apps a week after the setting first went into Error, with nobody changing anything that day.

FAQ

Is "Not applicable" the same as noncompliant?
No. It's a separate column in the policy and setting reports. Drill in before you act on it.

What does "Is active" mean in Intune compliance?
It's part of the built-in default compliance policy. The device has to stay in contact with Intune. If it doesn't report within the compliance status validity period (30 days by default, configurable from 1 to 120), it's treated as noncompliant.

What format does Windows Minimum OS version use?
major.minor.build.revision. Microsoft suggests running ver on a device to get the right value.

Why do new devices show "Not evaluated"?
It's the initial state after enrollment. It stays until the device checks in and compliance is evaluated.

Want the full runbook?

The Intune & M365 Admin Starter Pack includes baseline compliance guidance, break/fix cards and read-only PowerShell scripts, including a compliance policy summary and a managed-device snapshot. The scripts only read. They make no device or policy changes.

👉 https://cashflow4375.gumroad.com/l/joonf?utm_source=devto

Admin Pack Studio; not affiliated with Microsoft.

DEV Community