Contoso Legal LLP
For each platform, the devices enrolled in Intune and how many policies assigned to someone cover it. A device with no compliance policy counts as compliant unless Intune's compliance settings say otherwise, so Conditional Access can't tell it apart.
| Platform | Enrolled devices | Compliance policies | Configuration profiles | Endpoint security and settings catalog | App protection |
|---|---|---|---|---|---|
| Windows | 19 | 1 | 3 | 1 | |
| iOS/iPadOS medium | 1 | 0 | 0 | 0 | 1 |
| Android | 0 | 0 | 0 | 0 | 1 |
Policies that do nothing or leave a gap, and platforms with devices but no compliance policy.
| Policy | Kind | Platform | What to check |
|---|---|---|---|
| Android Outlook medium | App protection | Android | No PIN to open company apps |
| iOS/iPadOS medium | Platform | iOS/iPadOS | Devices are enrolled but no compliance policy is assigned (1 device) |
| Update ring Pilot medium | Update ring | Windows | Security updates paused |
| Android Outlook low | App protection | Android | Company data can be shared with any app |
| iPhone draft low | Compliance policy | iOS/iPadOS | Assigned to nobody, so it does nothing |
| Mac restrictions low | Device restrictions | macOS | Assigned to nobody, so it does nothing |
| Mac FileVault low | Disk encryption | macOS | Assigned to nobody, so it does nothing |
What a device must meet to count as compliant. Conditional Access can then let only compliant devices reach company data.
| Policy | Platform | Requires | Assigned to | Last changed |
|---|---|---|---|---|
| iPhone draft low | iOS/iPadOS | Password of 6+ characters, Not jailbroken or rooted | Nobody | 1 Feb 2026 |
| Windows baseline | Windows | Password of 8+ characters, BitLocker + 3 more
| All devices | 14 Aug 2026 |
How long Windows waits before installing monthly security updates and yearly feature updates, and how long before it restarts to finish them. Microsoft suggests no more than 7 days for security updates on most devices.
| Ring | Security updates after (days) | Feature updates after (days) | Restart deadline (days) | Paused | Drivers | Assigned to |
|---|---|---|---|---|---|---|
| Update ring Broad | 7 | 60 | 3 | No | Included | Sales, Except Project Phoenix |
| Update ring Pilot medium | 0 | 0 | 2 | Security | Left out | Board (filtered) |
Settings Intune pushes to devices. Settings shows the ones that matter most for security.
| Profile | Type | Platform | Settings | Assigned to | Last changed |
|---|---|---|---|---|---|
| Mac restrictions low | Device restrictions | macOS | Password of 10+ characters | Nobody | 1 Apr 2026 |
| Update ring Broad | Update ring | Windows | Security updates after 7 days, feature updates after 60 days, restart deadline 3 days | Sales, Except Project Phoenix | 1 May 2026 |
| Update ring Pilot medium | Update ring | Windows | Security updates after 0 days, feature updates after 0 days, restart deadline 2 days | Board (filtered) | 30 Sep 2026 |
| Windows firewall | Endpoint protection | Windows | Firewall on, Encrypts with BitLocker | All devices | 10 Jan 2026 |
Endpoint security policies (antivirus, firewall, disk encryption and the like), security baselines and settings catalog profiles.
| Policy | Platform | Settings | Assigned | Last changed |
|---|---|---|---|---|
| Defender antivirus | Windows | 14 | Yes | 1 Jul 2026 |
| Mac FileVault low | macOS | 3 | No | 1 Apr 2026 |
Rules for company data inside apps such as Outlook and Teams on phones, including personal phones Intune doesn't manage: a PIN to open them, and whether data can leave for other apps.
| Policy | Platform | PIN | Sharing data | Copy and paste | Backups | Encryption | Apps | Assigned to |
|---|---|---|---|---|---|---|---|---|
| Android Outlook medium | Android | Not required | With any app | Any app | Allowed | Encrypted | 2 | Sales |
| iOS Outlook and Teams | iOS/iPadOS | Required (6+ digits) | Managed apps only | Managed apps (paste in from any) | Blocked | When locked | 4 | All users |
Data from Intune policies (), Devices (), Groups and Teams (), Group nesting ().