Northwind Traders
For each platform, the devices enrolled in Intune and how many policies assigned to someone cover it. A device with no compliance policy counts as compliant unless Intune's compliance settings say otherwise, so Conditional Access can't tell it apart.
| Platform | Enrolled devices | Compliance policies | Configuration profiles | Endpoint security and settings catalog | App protection |
|---|---|---|---|---|---|
| Windows | 36 | 1 | 3 | 1 | |
| iOS/iPadOS medium | 1 | 0 | 0 | 0 | 1 |
| Android | 0 | 0 | 0 | 0 | 1 |
Policies that do nothing or leave a gap, and platforms with devices but no compliance policy.
| Policy | Kind | Platform | What to check |
|---|---|---|---|
| Android Outlook medium | App protection | Android | No PIN to open company apps |
| iOS/iPadOS medium | Platform | iOS/iPadOS | Devices are enrolled but no compliance policy is assigned (1 device) |
| Update ring Pilot medium | Update ring | Windows | Security updates paused |
| Android Outlook low | App protection | Android | Company data can be shared with any app |
| iPhone draft low | Compliance policy | iOS/iPadOS | Assigned to nobody, so it does nothing |
| Mac restrictions low | Device restrictions | macOS | Assigned to nobody, so it does nothing |
| Mac FileVault low | Disk encryption | macOS | Assigned to nobody, so it does nothing |
What a device must meet to count as compliant. Conditional Access can then let only compliant devices reach company data.
| Policy | Platform | Requires | Assigned to | Last changed |
|---|---|---|---|---|
| iPhone draft low | iOS/iPadOS | Password of 6+ characters, Not jailbroken or rooted | Nobody | 1 Feb 2026 |
| Windows baseline | Windows | Password of 8+ characters, BitLocker + 3 more
| All devices | 14 Aug 2026 |
How long Windows waits before installing monthly security updates and yearly feature updates, and how long before it restarts to finish them. Microsoft suggests no more than 7 days for security updates on most devices.
| Ring | Security updates after (days) | Feature updates after (days) | Restart deadline (days) | Paused | Drivers | Assigned to |
|---|---|---|---|---|---|---|
| Update ring Broad | 7 | 60 | 3 | No | Included | Sales, Except Project Phoenix |
| Update ring Pilot medium | 0 | 0 | 2 | Security | Left out | Board (filtered) |
Settings Intune pushes to devices. Settings shows the ones that matter most for security.
| Profile | Type | Platform | Settings | Assigned to | Last changed |
|---|---|---|---|---|---|
| Mac restrictions low | Device restrictions | macOS | Password of 10+ characters | Nobody | 1 Apr 2026 |
| Update ring Broad | Update ring | Windows | Security updates after 7 days, feature updates after 60 days, restart deadline 3 days | Sales, Except Project Phoenix | 1 May 2026 |
| Update ring Pilot medium | Update ring | Windows | Security updates after 0 days, feature updates after 0 days, restart deadline 2 days | Board (filtered) | 30 Sep 2026 |
| Windows firewall | Endpoint protection | Windows | Firewall on, Encrypts with BitLocker | All devices | 10 Jan 2026 |
Endpoint security policies (antivirus, firewall, disk encryption and the like), security baselines and settings catalog profiles.
Rules for company data inside apps such as Outlook and Teams on phones, including personal phones Intune doesn't manage: a PIN to open them, and whether data can leave for other apps.
| Policy | Platform | PIN | Sharing data | Copy and paste | Backups | Encryption | Apps | Assigned to |
|---|---|---|---|---|---|---|---|---|
| Android Outlook medium | Android | Not required | With any app | Any app | Allowed | Encrypted | 2 | Sales |
| iOS Outlook and Teams | iOS/iPadOS | Required (6+ digits) | Managed apps only | Managed apps (paste in from any) | Blocked | When locked | 4 | All users |
Data from Intune policies (), Devices (), Groups and Teams (), Group nesting ().