Mark Devices with No Compliance Policy as Not Compliant in Intune

Implement identity and compliance

You have a Microsoft 365 tenant that contains the devices shown in the following table. exhibit The devices are managed by using Microsoft Intune. You create a compliance policy named Policy1 and assign Policy1 to Group1. Policy1 is configured to mark a device as Compliant only if the device security settings match the settings specified in the policy. You discover that devices that are not members of Group1 are shown as Compliant. You need to ensure that only devices that are assigned a compliance policy can be shown as Compliant. All other devices must be shown as Not compliant. What should you do from the Microsoft Intune admin center?

  1. From Device compliance, configure the Compliance policy settings. Correct Answer
  2. From Endpoint security, configure the Conditional access settings.
  3. From Tenant administration, modify the Diagnostic settings.
  4. From Policy1, modify the actions for noncompliance.
Answer Correct answer: A — From Device compliance, configure the Compliance policy settings to mark devices with no policy assigned as Not compliant.

Community Votes

A
88%
D
12%

88% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

Tests the specific tenant-level setting 'Mark devices with no compliance policy assigned as' which defaults to Compliant but must be changed to Not compliant for strict enforcement.

Learn how to configure Microsoft Intune to mark devices without assigned compliance policies as Not compliant, preventing false positive status reporting.

Many candidates choose option D (modifying actions for noncompliance), mistakenly believing that policy-specific settings can affect devices that are not even targeted by that policy.

Community Discussion (14 comments)

ThomasE 👍 1 Selected: A
Was a little confused, because you can also get there by Endpoint Security, Device compliance, Compliance policy settings. Same screen, slightly different way to get there.
Besxp 👍 1 Selected: A
🔹 The key setting: "Mark devices with no compliance policy assigned as: Compliant / Not compliant" ❗ Why is this setting important? By default, this setting is "Compliant", meaning devices with no assigned policy are still shown as compliant, which leads to false positives in compliance reporting. If you want only devices with a compliance policy assigned to be marked compliant, you must change this global setting to: ✅ "Not compliant" This ensures devices not targeted by Policy1 (e.g., devices not in Group1) are marked Not Compliant. https://learn.microsoft.com/en-us/intune/intune-service/protect/device-compliance-get-started#compliance-policy-settings
sVn01 👍 1 Selected: A
seems correct
AleFCI1908 👍 2 Selected: D
i think it is D. i think it is the most direct way to mark as not compliant all non compliant devices or devices with no policy
Besxp 👍 1
D only impacts devices targeted by Policy1, not untargeted devices. The issue is outside Policy1's scope.
martinods 👍 3
why not D ?
RomanV 👍 1 Selected: A
If you use device compliance status with Conditional Access policies, review how your tenant configures the Mark devices with no compliance policy assigned as option, which you manage under Compliance policy settings. https://learn.microsoft.com/en-us/defender-endpoint/minimum-requirements?view=o365-worldwide#supported-windows-versions
ergacharsk 👍 1 Selected: A
A. From Device compliance, configure the Compliance policy settings.
MR_Eliot 👍 1 Selected: A
Correct
Merrybob 👍 4 Selected: A
A. From Device compliance, configure the Compliance policy settings. Ref: https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started#:~:text=Device%20compliance%20%3E%20Compliance%20policy%20settings
Merrybob 👍 2
Ref: https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started#:~:text=Mark%20devices%20with,are%20considered%20noncompliant.
yosry 👍 1 Selected: A
SEEMS CORRECT
h38jhd38k 👍 3
https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started
BJS78 👍 9
Turn "Mark devices with no compliance policy assigned as" to "Not compliant"

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Expert Analysis

Why the Answer Is Correct

The correct action is to configure the global compliance policy settings from the Device compliance section. Specifically, you must navigate to Device compliance > Compliance policy settings and change the toggle for "Mark devices with no compliance policy assigned as" from its default value of "Compliant" to "Not compliant." This ensures that any device managed by Intune but not explicitly assigned a compliance policy (like Group1's policy) is reported as Noncompliant.

Why the Other Options Are Wrong

Option D is incorrect because modifying actions for noncompliance within Policy1 only affects devices that are members of Group1 and have violations; it cannot influence the status of devices outside that scope. Option B refers to Endpoint Security and Conditional Access, which govern access grants but do not control the underlying compliance status reporting logic for unassigned devices. Option C involves Diagnostic settings, which are unrelated to compliance state determination.

Community Comment Notes

Community consensus strongly supports Option A. As user Besxp noted, "D only impacts devices targeted by Policy1, not untargeted devices," highlighting the scope limitation of policy-specific actions. User Merrybob provided the official Microsoft Learn reference confirming this setting location. Another commenter clarified that while Endpoint Security leads to the same screen, the primary navigation path is via Device Compliance.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

Exam Strategy

When dealing with compliance reporting issues, always check if the problem is scope-related (policy assignment) or configuration-related (global settings). If an issue affects unassigned devices, look for global toggles rather than individual policy edits.

Frequently Asked Questions

Why doesn't changing noncompliance actions in Policy1 work?

Policy-specific actions only apply to devices assigned to that policy. Devices not in Group1 are unaffected by Policy1's internal settings.

Where exactly is the 'Mark devices... as' setting located?

It is found under Intune Admin Center > Device compliance > Compliance policy settings. It is a global tenant setting, not per-policy.

More MD-102 FAQ →

Related Analysis

You have a Microsoft 365 E5 subscription and use Microsoft I

A-Grade

You have a Microsoft 365 subscription that contains devices

S-Grade

You have a Microsoft 365 E5 subscription. You need to ensure

A-Grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide