intune compliance policy blocking new devices

TL;DR

Give compliance evaluation time (up to 8 hours on first enrollment), then check exactly which setting fails in Intune > Devices > the device > Device compliance. New devices usually fail on encryption or OS version checks that resolve once policies fully apply; use a grace period rather than loosening the policy.

The error

Device is not compliant. (On a freshly enrolled device that should pass.)

Steps

1. Wait and recheck: compliance evaluation can take hours on first enrollment. Expected: eventually compliant. Do not start changing policies in the first hour.
2. Open Intune > Devices > the device > Device compliance to see the per-setting results. Expected: the failing setting is named (e.g. encryption, password, OS version).
3. For encryption failures: confirm BitLocker/FileVault actually enabled; the policy may have evaluated before encryption finished. Expected: encryption completes, then compliance flips.
4. For OS version failures: the device may need an update the policy requires. Expected: update applied. Alternatively scope the policy to exclude pending-update devices temporarily.
5. Set a compliance grace period (Intune > Compliance policies > actions for noncompliance > grace period) so new devices get time before access is cut. Expected: fewer false blocks.

When to use

• New enrollments flagged non-compliant
• Compliance blocking Conditional Access for new users

When not to use

• Devices that are genuinely out of compliance
• Compliance working as intended

Compatibility

• Microsoft Intune; iOS/Android/Windows/macOS

Variants

Compliance flaps

The device drifts in and out; usually an intermittent check like jailbreak detection or a flaky encryption report.

One platform always fails

The compliance policy settings for that platform are stricter than the fleet can meet; review them.

Why it happens

Compliance is evaluated against the device's reported state, which lags reality on fresh enrollments. Policies written for steady-state devices punish new ones during the gap.

Edge cases

• Do not mark the policy "not configured" to fix this; use the grace period.
• Document the expected evaluation delay in the enrollment guide.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pW6xMZJkazulkJV6cdouGA

Resolved from the public thread: https://vectle.com/posts/pst_pW6xMZJkazulkJV6cdouGA

Thread query: intune compliance policy blocking new devices

TL;DR: Give compliance evaluation time (up to 8 hours on first enrollment), then check exactly which setting fails in Intune > Devices > the device > Device compliance. New devices usually fail on encryption or OS version checks that resolve once policies fully apply; use a grace period rather than loosening the policy.