Intune is switched on. Is it actually checking your devices?

Most security advice for small business is a shopping list. Turn on MFA. Get Defender. Filter your email. All good advice, and I would give most of it myself.

What the list rarely mentions is the device. When someone signs in to your Microsoft 365, does anything actually check the laptop or phone they are signing in from? Or does it just check the password and the MFA prompt, and let any device through?

More often than you would hope, the honest answer is the second one. Intune is licensed, and sometimes it is even set up. But nothing connects it to the front door. This guide walks you through how to find out where yours sits, using screens you can open yourself, in about half an hour.

Three things that sound the same but are not

People tend to treat these as one thing. They are three separate steps, and each one can be done without the others.

1. Intune is licensed. You pay for it. If you are on Microsoft 365 Business Premium, it comes in the box. That on its own does nothing.
2. Devices are enrolled, with compliance policies. Each work device reports in to Intune, and a policy decides what "healthy" means: encryption on, a PIN or password set, Windows reasonably up to date. Intune then marks each device compliant or not compliant.
3. Conditional Access uses that result. A rule in Microsoft Entra ID says a device has to be marked compliant before it gets into email and files. This is the step that turns a report into a locked door.

Plenty of businesses have step one. Some have step two. Step three is the one that tends to be missing, and without it a compliance report is just a report. A staff member's home PC with no encryption and updates switched off can still open Outlook on the web, because nothing was ever told to stop it.

If Intune itself is new to you, start with my plain-English explainer on what Microsoft Intune does and come back.

The default setting that catches people out

There is one tenant-wide setting worth knowing about before you look at anything else.

In the Intune admin centre, under Endpoint security > Device compliance > Compliance policy settings, there is an option called Mark devices with no compliance policy assigned as. Microsoft's own documentation lists the default as Compliant.

In plain terms: a device that has never been given any rules is treated as passing them. If you later add a Conditional Access rule that requires a compliant device, a device with no policy assigned can still get through while that default stays in place. Microsoft recommends changing this to Not compliant if you use compliance with Conditional Access.

That is not a flaw in Intune. It is a sensible default for a tenant that has not been set up yet. It just means "we turned on the compliance rule" and "only healthy devices get in" are not the same statement until someone has looked at this setting.

The check, step by step

You will need an admin login, or someone who has one sitting next to you. Nothing below changes anything. It is all looking.

1. Confirm what you are licensed for

In the Microsoft 365 admin centre, go to Billing > Your products. You are looking for Microsoft 365 Business Premium, or an enterprise plan that includes Intune and Entra ID P1.

If you are on Business Basic or Business Standard, Intune and Conditional Access are not part of that licence. That is useful to know on its own, because it means the rest of this check will come up empty for a reason, not because of a misconfiguration.

2. Count the devices

Open the Intune admin centre at intune.microsoft.com and go to Devices > All devices.

Now do the simple maths. How many people work for you? How many laptops, desktops and work phones do you actually own? Compare that with the list.

Things to look for:

• Fewer devices than you expected. Some machines were never enrolled. The new starter's laptop from last year is a common one.
• Old devices still listed. Machines that have not checked in for months, often from people who have left. The last check-in date is on the list.
• Only one kind of device. Windows laptops enrolled, but no Macs or phones, even though the team uses them for work email.

3. See whether any compliance policies exist

Go back to Endpoint security > Device compliance. You want at least one policy for each platform your team uses, and each policy should be assigned to a group of real users or devices.

A policy that exists but is assigned to nobody is surprisingly common. It looks finished in the list and does nothing.

While you are there, the compliance status view shows how many devices are compliant, not compliant, or have not been evaluated. A large "not evaluated" number usually means policies are not reaching the devices you think they are.

4. Check the default setting

Go to Endpoint security > Device compliance > Compliance policy settings and read the value of Mark devices with no compliance policy assigned as. Write down whether it says Compliant or Not compliant.

5. Look for the rule that actually enforces it

Open the Microsoft Entra admin centre at entra.microsoft.com and go to Entra ID > Conditional Access > Policies.

Open each policy and look under Grant for Require device to be marked as compliant. Then check the state of that policy. There are three:

• On means it is enforcing.
• Report-only means it is logging what it would have done, but letting everyone through.
• Off means nothing.

Report-only is the right way to start. It is not meant to be where a policy lives forever, and I do find ones that were set up for testing and never switched on.

If the Conditional Access page is empty and your tenant uses security defaults instead, that is a different and simpler set of protections. Security defaults are a decent starting point for MFA, but they do not require a compliant device.

6. Check what really happened at sign-in

This is the part that tells you the truth, whatever the settings say.

In the Entra admin centre, go to Entra ID > Monitoring & health > Sign-in logs. Pick a few recent sign-ins from different staff and open them. The Device info tab shows whether that device was compliant and whether it was managed. The Conditional Access tab shows which policies applied and what the result was.

If you see sign-ins to email and SharePoint from devices that show as not managed, and they succeeded, you have your answer. Those are the machines nothing is checking.

Closing the gap without locking everyone out

If the check turns up gaps, the fix is not complicated, but the order matters. Doing it backwards is how a business ends up with half the office unable to open email on a Monday.

• Compliance policies first. Create them for each platform and assign them. Microsoft's own guidance is to have a compliance policy in place and at least one compliant device before you build the Conditional Access rule.
• Enrol the devices you own. Get the company laptops reporting in and compliant before anything is enforced. Requiring a compliant device does not stop a new device from enrolling, so this can keep going after the rule is on.
• Decide what to do about personal phones. Most small businesses do not want to fully manage a staff member's own phone, and staff do not want that either. Intune can protect just the work apps on a personal phone instead. Decide this on purpose, not by accident.
• Keep an emergency admin account out of the rule. One break-glass account, excluded from the policy and stored safely, so one mistake does not lock every admin out.
• Report-only, then review, then On. Run the new rule in report-only for a week or two. Read the sign-in logs. Fix the devices it would have blocked. Then switch it on.
• Change the default setting last. Once every real device has a policy, set Mark devices with no compliance policy assigned as to Not compliant.

What this does not do

A compliant device is a healthier device. It is not a guarantee.

It will not stop someone typing their password into a convincing fake login page on a perfectly compliant laptop. It does not replace MFA, patching, backups, or staff who know what a dodgy invoice email looks like. What it does is remove one easy path: an unknown, unencrypted, out-of-date machine quietly getting the same access as the ones you look after.

That is why managed devices sit alongside MFA, email authentication and patching in The Standard, the baseline every managed client of mine runs on, rather than replacing any of them.

If the answers come back fuzzy

Run the six steps and write down what you find. If you can answer all of them clearly, you are ahead of a lot of businesses. If the answers are vague, or you could not find the screens, that is a finding too.

Getting compliance and Conditional Access working together is a core part of the Microsoft 365 work I do for Brisbane businesses. If you would rather I ran the check across your tenant and gave you the results in writing, get in touch. And if you want the device side looked after for you from here on, that is part of managed IT.