A device stuck as "Not compliant" can block sign-in entirely if it's tied to a Conditional Access policy — the fix starts with finding out exactly which rule is failing, not guessing.

Steps to Diagnose It

1. In the Intune admin center, go to Devices > All devices and open the affected device.
2. Click Device compliance to see a breakdown of every policy applied and which specific setting is failing — this is the most important step, since "noncompliant" alone doesn't say why.
3. Common causes include: an outdated OS version, disk encryption not enabled, no PIN/password set, or the device simply hasn't checked in recently enough for its status to update.
4. Fix the underlying issue on the device (e.g. install the pending update, turn on encryption).
5. Force a resync from the device: open Company Portal > Settings and tap/click Sync, or trigger a remote sync from the device's page in the admin center.

Common Questions

The device meets every requirement but still shows noncompliant. Why?

This is usually a stale status — the device hasn't checked in with Intune recently enough to report its current state. A manual sync from the Company Portal app almost always resolves it within a few minutes.

Can I temporarily exempt one user from a compliance policy?

Yes — remove them from the policy's assigned group (or add them to an explicit exclusion group) rather than disabling the policy for everyone, so the rest of your organization stays protected while you resolve the one-off issue.