A compliance policy defines the minimum bar a device has to meet — encryption on, OS up to date, no jailbreak — before it's trusted with company data.

Steps

1. Sign in to the Microsoft Intune admin center.
2. Go to Devices > Compliance policies > Policies, then click Create Policy.
3. Choose the platform (Windows, iOS/iPadOS, Android, macOS) — you'll need a separate policy per platform.
4. Set your compliance rules, e.g. minimum OS version, require device encryption, require a password/PIN, and (for mobile) block jailbroken or rooted devices.
5. Under Actions for noncompliance, configure what happens when a device fails — commonly, sending the user an email and marking the device noncompliant immediately, with an option to block access after a grace period.
6. Assign the policy to the appropriate user or device group.
7. Review and click Create.

Common Questions

Does a compliance policy block access on its own?

Not by itself — compliance policies just mark a device as compliant or not. You need a Conditional Access policy that says "require compliant device" to actually enforce it and block noncompliant devices from signing in.

What happens to a device the moment it goes out of compliance?

It depends on your noncompliance actions and grace period settings — typically the user gets a notification first, and access is blocked only after the grace period expires if the issue isn't fixed.