Intune Non-Compliance Investigation Runbook

Primary story: INTUNE-017 — JASONR-2023 non-compliant investigation Scope: Any Intune-managed device in nonCompliant state, including corporate laptops, contractor machines, and any BYOD device under compliance policy. Owner: Rory (approver) / Kobe (investigation) Related: Intune Orphaned Devices, Kill Chain Audit Policy

What "non-compliant" means in our tenant

An Intune device becomes nonCompliant when it fails one or more rules in an assigned compliance policy. At Cirius the policies cover:

1. Encryption — BitLocker enabled with recovery key escrowed to Entra
2. OS update — no Windows update pending more than 14 days
3. Defender status — Microsoft Defender real-time protection enabled, signatures < 7 days old, no active threats
4. Firewall — Windows Defender Firewall enabled on all profiles
5. Minimum OS version — Windows 10 22H2 or later, Windows 11 23H2 or later
6. Secure Boot + TPM — Secure Boot on, TPM 2.0 attested
7. Password policy — screen lock under 15 min, complexity enforced

A device failing any one rule flips to nonCompliant and loses access to resources protected by the Conditional Access policy Require compliant device.

Investigation procedure

Step 1: Identify the failing rule(s)

From the Intune admin center:

Devices → Windows → select device → Device compliance

This shows each assigned compliance policy and which specific setting flipped the device to non-compliant. Capture: policy name, setting name, current value, required value, last evaluation time.

Via Graph:

GET https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/{id}/deviceCompliancePolicyStates

If Kobe lacks DeviceManagementManagedDevices.Read.All in practice (known limitation — see key-learnings.md), fall back to the Intune admin center UI or ask Rory to pull via portal.

Step 2: Classify the failing rule

Rule	Typical root cause	Fix location
Encryption	BitLocker suspended for servicing, TPM cleared	On-device
OS update	User deferred restart repeatedly	On-device + user contact
Defender — real-time off	User or third-party AV disabled it	On-device + policy check
Defender — stale signatures	Device offline > 7 days	On-device (network connect)
Defender — active threat	Genuine malware or false positive	Incident response
Firewall	Third-party firewall/VPN disabled Windows FW	On-device + policy
OS version	Hardware limitation or deferred upgrade	Upgrade or plan replacement
Password policy	Local group policy override	GPO / Intune config profile

Step 3: Correlate with user state

• Is the assigned user active in Entra?
• Has the user signed in to the device in the last 30 days?
• Is the device a corporate asset or a contractor / BYOD device?

Contractor machines are common for non-compliance findings because the device is not fully under our management lifecycle — we assign compliance policies but do not control patching cadence. These need the escalation path in Step 6.

Step 4: Remediation (corporate devices)

Primary remediation, in order of preference:

1. Ask the user to run remediation themselves — Windows Update, re-enable BitLocker/Defender, restart. Use the user-facing message from Intune Company Portal.
2. Push a remediation script via Intune Endpoint Analytics proactive remediations for common cases (restart BITS, kick Defender signature update, re-enable firewall profile).
3. Live response via Defender for Endpoint for hands-on cases where the user cannot self-remediate.
4. Re-image via Autopilot reset if the device is persistently non-compliant and the user has another device available.

Step 5: Remediation (contractor / BYOD devices)

Contractor devices get a narrower treatment because we do not own them:

1. Contact the contractor directly with the specific failing rule and required action.
2. Give a fixed remediation window (typically 72 hours) before Conditional Access blocks them.
3. If the contractor cannot meet the requirement (old hardware, OS mismatch), escalate to Rory: either grant a time-bounded policy exemption with compensating controls documented, or terminate the contractor's access.
4. Record the exemption in the device record's notes and in the compliance register.

Step 6: Escalation triggers

Escalate to Rory immediately (do not remediate quietly) when:

• The failing rule is Defender — active threat (genuine malware). This is an incident — follow Incident Response.
• The device has been non-compliant for more than 14 days.
• The user refuses to remediate.
• A contractor device cannot meet policy and is still accessing PHI-adjacent resources.
• The same device recurs non-compliant more than twice in 90 days.

Procedure — JASONR-2023 (2026-04-16)

Device name suggests Jason R's Windows device (2023 vintage). Likely corporate laptop, not contractor.

Investigation steps:

1. Pull device record from Intune admin center: confirm assigned user, serial, last sync, OS version, compliance state per policy.
2. Identify the failing rule(s) per Step 1 above.
3. Contact Jason directly with the specific fix path:
   • If OS update: instruct Jason to run Windows Update, restart, confirm version.
   • If BitLocker: manage-bde -status C: to confirm; if suspended, manage-bde -protectors -enable C:.
   • If Defender: open Windows Security, confirm real-time protection is on, run a signature update (MpCmdRun.exe -SignatureUpdate), run a quick scan.
4. After Jason reports remediation complete, force a sync from Company Portal (Settings → Accounts → Access work or school → Info → Sync) and wait for the next compliance evaluation (up to 8 hours, or force via Graph).
5. Confirm complianceState returns to compliant.
6. Record the finding and remediation in the INTUNE-017 ticket with the specific failing rule and the time from non-compliant → compliant.

If the failing rule turns out to be Defender active threat, escalate immediately per Step 6 — do not ask Jason to remediate malware himself.

Preventing recurrence

• Proactive remediation scripts deployed via Intune for the top 3 recurring failure modes (BitLocker re-enable, Defender signature kick, firewall profile re-enable).
• Monthly review of non-compliance trends as part of monthly security review.
• Update policies quarterly to match current Microsoft baseline.

References

• Intune Orphaned Devices
• Incident Response
• Kill Chain Audit Policy
• Monthly Security Review
• Microsoft docs — Monitor device compliance: learn.microsoft.com/mem/intune/protect/compliance-policy-monitor
• Microsoft docs — Proactive remediations: learn.microsoft.com/mem/analytics/proactive-remediations