Best Practices for Intune Compliance Policies in Microsoft 365

Endpoint exploitation is an increasing concern to businesses worldwide since using personal devices has become a norm among employees. With Intune compliance policies, organisations can ensure that all devices connected to their network comply with security standards.

The modern-day work environment, coupled with technological advancements, necessitates implementing security protocols pertaining to devices connected to an organisational network as employees work from remote locations.

Such an environment is favourable to businesses as it allows them to access and acquire dynamic talent. In addition, it also allows employees to work from their desired locations. However, it also poses challenges for network security that can be addressed by deploying Intune compliance policies. 

Network end-points are a common target for cybercriminals as they can be easily exploited to gain access to organisational and customer data. Businesses are allocating an increased amount of capital to endpoint security solutions to avoid undergoing such events. In fact, market forecasts indicated that the global endpoint security solutions market might cross $19 billion in 2025. 

CTOs considering implementing tighter endpoint security for their organisation have a vast majority of options readily available in the market. However, the utilisation of Microsoft Intune remains the most relied-upon choice by many around the globe. Although Microsoft Intune can be seen as the most competent solution to tackle network endpoint exploitation, deploying it without adequate knowledge can hinder its effectiveness. 

As a Microsoft Gold Partner, we can help your organisation deploy and utilise Microsoft Intune to its full potential. 

What Is Microsoft Intune? 

Microsoft Intune is a cloud-based network endpoint management solution that allows organisations to manage all their devices including desktop computers, mobile devices, or virtual endpoints. Nowadays, employees working from remote locations may use their personal or public devices to access an organisational network, resources, and applications.

It was initially launched in 2011 as Windows Intune, and since then, it has been migrated to the Microsoft Azure public cloud. The acquisition and deployment of the solutions allow Chief Information Security Officers (CISOs) to ensure the protection of data on organisation-provided and personal devices. 

Microsoft Intune comes with built-in reporting and compliance features that function in accordance with a never-trust, always-verify approach dictated by the Zero Trust security model. In addition, it has various compliance and security policies that can be used to enhance the effectiveness of endpoint security. 

What Are Intune Compliance Policies? 

Microsoft Intune compliance policies are features that allow organisations to ensure that all devices used by employees adhere to the organisation’s security standards. Organisations having employees worldwide know that these employees use varying devices, and some might not meet compliance standards. 

In cases where a device fails to meet these standards, Microsoft Intune ensures that the non-complying device is remotely locked. Afterwards, alerts pertaining to the device are sent to the appropriate employee.

However, in order to ensure that Intune is being used to its full potential, information technology (IT) security teams must ensure that: 

• Compliance protocols for employees and devices are defined. 
• Actions initiated for non-compliant devices, and alerts of non-compliance are configured. 

In addition, compliance policies can also be combined with conditional access to ensure that employees and devices that do not comply with such standards are blocked from gaining access. Intune compliance policies can be further divided into compliance policy setting and device compliance policies. Network security teams must understand the difference between the two to ensure effective deployment. 

Compliance Policy Settings 

Prior to deploying Intune, organisations must understand that compliance policy settings are built-in protocols received by every device. These policies provide a baseline pertaining to the functionality of compliance policies within your Intune environment. The baseline protocols include identifying the devices that follow these policies and are compliant or non-compliant. 

It’s critical to understand that these compliance policies determine how the compliance services will interact with the devices. In addition, these policies are distinct from those that are defined or configured under the device compliance policy. Security teams tasked with deploying, managing, and upgrading such policies are required to use the Microsoft Intune admin centre. 

Device Compliance Policy 

Security teams must understand that the device compliance policy is a set of platform-specific rules that can be configured. Once configured as required, these rules can be deployed to multiple groups of users or devices.

It’s preeminent to mention that these rules contain requirements that a device must adhere to for it to be classified as compliant. Such requirements may include operating system (OS) versions, disk encryption protocols, etc. 

In addition, these requirements may include that a device has not been jail-broken or rooted or is at a threat level. The threat level for such devices is determined by a threat management software that has been integrated with Microsoft Intune.

Device compliance policy settings depend on the platform that was selected when the policy was created. Furthermore, they can also be integrated with conditional access controls to restrict access to organisational resources for devices that are non-compliant. 

Compliance Status Monitoring 

Microsoft Intune also includes a device compliance dashboard that allows security administrators to monitor the compliance status of each device connected to their network. However, it’s critical to know that the device compliance states are stored in two separate databases that include the Intune database and the Azure Active Directory (AD).

Security teams should know that Intune compliance policies are labelled using different policy states that include: 

• Compliant – the device is in compliance with one or more policies. 
• In-grace period – the device has been targeted with one or more policies, however, the policies have not been applied yet. 
• Not evaluated – applies to newly enrolled devices due to various reasons such as:
  • No compliance policy has been assigned. 
  • The device was not checked since the compliance update. 
  • The device is not associated with a specific user. 
• Non-compliant – the device has failed to apply the policies
• Not-synced – the device has failed to report its compliance status. 

MDM and MAM in Microsoft Intune 

The bring-your-own-device (BYOD) work culture has now led to an organisational environment where employees are using their personal computers or mobile devices for their tasks. Therefore, IT teams must enforce access and management protocols for such devices using Mobile Device Management (MDM) and Mobile Application Management (MAM). 

Using the MDM and MAM approaches, in combination with Intune compliance policies, allows network security teams to protect all Microsoft 365 assets and data on all devices. However, prior to utilising these approaches, it’s important to note that MDM is an approach that is limited to controlling devices. Whereas MAM is an approach that expands the control horizon encompassing application on the devices used to gain access to organisational resources.

Intune Compliance Policies for MDM

It includes a device profile that allows organisations to manage and control mobile devices remotely as they require. In addition, it also installs an agent on the devices allowing organisations to initiate queries pertaining to the devices’ status.

When utilising MDM, it’s important to understand that MDM can fully manage organisational devices for shared or personal use. It also allows organisations to ensure that the enrollment and configuration of devices and installation of applications are made possible through IT and is more focused on security and compliance.

However, to ensure that the device remains secure and compliant, businesses must use Intune compliance policies. The requirements for each compliance policy will vary around encryption, code integrity, device lock options and more. 

Intune Compliance Policies for MAM

This allows businesses to protect and have granular control over corporate resources and granular devices. MAM ensures that corporate apps, once installed on a BYOD system, operate in a secure container, allowing organisations to ensure that business and personal data are kept separate. Where MDM has control over the entire device, MAM only controls corporate applications that are installed on personal devices.  

However, organisations must configure and deploy application protection policies to protect data stored within these corporate applications. It’s important to know that such policies are highly effective when devices hold corporate and personal data. 

The policies ensure that organisations are able to control the setting and functions of corporate applications. In addition, they help define how corporate applications must be stated and are used to configure action when certain launch protocols are not met. 

Best Practices for Intune Compliance Policies

Standardising device compliance protocols has now become a necessity that businesses must adhere to in order to ensure protection against network endpoint exploitation. Using Microsoft Intune is the most competent approach to secure network endpoints. 

However, challenges when deploying Intune compliance policies may occur due to inadequate abilities. Therefore, learning about some best practices for deploying such policies can improve their effectiveness. Some of these best practices include: 

Creating Enrollment Settings 

Defining the device enrollment flow is the first and most critical aspect of deployment compliance policies. When initiating the process, it’s important to ensure that the variety of devices being enrolled has been defined and organisations are able to meet the enrollment requirements for each device. However, it’s important to consider that: 

• Devices that are operating on iOS require organisations to set up push notification certificates with Apple, and that must be renewed each year. However, it’s important to know that setting up such a certificate will allow Microsoft permission to send user and device data back to Apple to recreate and upload the certificates. 
• Devices that are operating on an Android OS require security admins deploying Intune compliance policies to connect a managed Google Play account. The connected account is then used to enable Android Enterprise. 
• Devices that operate on Windows OS come with multiple enrollment options that allow network security administrators to automate the process. 

Deploying Conditional Access 

Conditional access policies allow security admins to a set of conditionals that are applicable to a particular group or profile. Users or devices within that group can not access other organisation emails and cloud applications such as Azure Virtual Desktop (AVD). When considering the use of such access policies, it’s critical to know that these conditions may include: 

• Connecting via a secure or provisioned internet connection. 
• Using the latest or specified version of an operating system. 
• Refraining from the use of unauthorised or unapproved applications. 
• Enabling two-factor or multi-factor authentication. 
• Creating passwords that are lengthy and complex. 

The exact conditional access requirement will depend on the nature and industry of the business. Therefore, organisations must consider various factors pertaining when determining these access policies. These factors may include the data sensitivity and job requirements of an employee in particular device groups. 

Using Security Baselines 

Security baselines are an integral component of Intune compliance policies. Security baselines are pre-configured settings that allow you to deploy compliance policies to different device groups and users. Using security baselines is an effective approach that allows organisations to compensate for their lack of expertise pertaining to cyber security. 

Modifications to these settings can be made as, and when required, however, they are highly effective on their own. In addition, these settings are regularly updated by Microsoft to ensure that they adhere to the latest security guidelines. Despite this, organisations should consider them as a starting point and tailor them according to their individual circumstances. 

Reviewing Compliance Policies 

Organisations must understand that they will need to regularly review their reports to identify any potential issues with the compliance policies. In addition, it will also allow them to ensure that all devices are updated with the latest security patch, as this can help reduce the risk of endpoint exploitation and data breaches. 

Furthermore, reviewing compliance policies on a regular basis and helping security teams identify a trend of non-compliance among users and devices. This will also help gain insights about the latest threats and vulnerabilities that are arising in their devices and in the industry. These factors, in combination, will help them develop appropriate responses to tackle issues that are hindering satisfactory compliance.  

Final Thoughts 

The modern work environment now dictates organisational adaptation to remote work. Although such a culture benefits organisations and employees, it poses security challenges as employees use personal devices to gain access to organisational resources. Such circumstances lead to end-point explication and data breaches. 

However, businesses use Intune compliance policies to ensure that all devices, whether organisational or personal, comply with security standards. Contact us now to learn more about integrating Microsoft Intune into devices connected to your organisational network.

Clint Shiels

With over 20 years in the technology space and a background focused on Microsoft and Security, my methodology is to understand business requirements and outcomes first and foremost then set out a roadmap and delivery plan to achieve these through advisory and modern workplace delivery services.