IT Toolbox
Guide

How to diagnose a noncompliant Intune device

This BAOI guide provides a structured method for diagnosing an intune device that is not compliant without multiplying unnecessary changes.

TopicMicrosoft 365 →
⌚ About 2 min read
View my favorites
Microsoft 365. Intermediate. 15-30 min

This BAOI guide provides a structured method for diagnosing an intune device that is not compliant without multiplying unnecessary changes.

Avant de commencer : adaptez toujours les commandes et manipulations à votre environnement. Sur un système de production, prévoyez une backup ou un retour arrière lorsque l’action peut modifier la configuration.

Étapes à suivre

  1. 1

    Set perimeter

    Identify the equipment, service, affected users and start time.

  2. 2

    Collect Elements

    Record the exact messages, logs and useful settings.

  3. 3

    Test methodically

    Start with the basic dependencies before the application components.

  4. 4

    Apply correction

    Change only the identified parameter or component.

  5. 5

    Validate

    Rewrite the full scenario and document the result.

À retenir

  • Keep the initial values for a backwards.
  • Avoid multiple simultaneous changes.
  • Compare with a functional configuration when possible.
← All les guides
Technical deep dive

Intune / Conditional Access: read the exact decision before excluding

Technical checkpoints

  • A non-compliant device can fail a compliance rule, device-state evaluation or sync delay; read the exact failing setting.
  • AADSTS53003 generally means access was blocked by Conditional Access; Sign-in logs show applied policies and their result.
  • The What If tool simulates user, app, platform, location and conditions without changing policy.

Read the sign-in

Open the exact sign-in and compare Grant Controls, Conditions and device state.

Entra ID > Sign-in logs > Conditional Access
Intune > Devices > Compliance > Per-setting status

Topic-specific pitfalls

  • Adding a broad exclusion for testing can create a security gap and hide the actual non-compliant setting.
  • A policy in Report-only does not have the same effect as Enabled; read the mode.

How to validate

  • The compliance setting passes and the new sign-in shows intended policies as Success/Not applied.
  • No unjustified temporary exclusion remains active.

Operational diagnosis

Intune noncompliance should be traced from device identity and check-in through the individual compliance setting that failed. Do not treat the overall “noncompliant” label as the root cause.

Step-by-step checks

  1. Confirm the device is the expected Entra/Intune object and has checked in recently.
  2. Open per-setting compliance details and identify the first concrete requirement reporting noncompliant or error.
  3. Check assignment scope, filters, grace period and conflicting policies for the user/device.
  4. Correlate device-side enrollment/join state with Intune and Entra sign-in information.

Useful verification commands

Run only the commands that match the platform you are troubleshooting and capture the output before making a configuration change.

dsregcmd /status

How to validate the fix

After remediation and a successful sync, the individual setting must become compliant and the aggregate device status must update without creating a duplicate/stale device object.

Evidence to keep

Record device ID, last check-in, failing setting, policy name/assignment and the post-remediation sync time.

Related BAOI resources: IT tools · procedures · IT dictionary.

♡ 0