Mark Devices with No Compliance Policy as Not Compliant in Intune

MD-102 By islever Editorial Last updated

Implement identity and compliance

Short answer

A From Device compliance, configure the Compliance policy settings to mark devices with no policy assigned as Not compliant.

Question

You have a Microsoft 365 tenant that contains the devices shown in the following table.
Exhibit: Mark Devices with No Compliance Policy as Not Compliant in Intune
The devices are managed by using Microsoft Intune.
You create a compliance policy named Policy1 and assign Policy1 to Group1. Policy1 is configured to mark a device as Compliant only if the device security settings match the settings specified in the policy.
You discover that devices that are not members of Group1 are shown as Compliant.
You need to ensure that only devices that are assigned a compliance policy can be shown as Compliant. All other devices must be shown as Not compliant.
What should you do from the Microsoft Intune admin center?
  1. From Device compliance, configure the Compliance policy settings. Correct Answer
  2. From Endpoint security, configure the Conditional access settings.
  3. From Tenant administration, modify the Diagnostic settings.
  4. From Policy1, modify the actions for noncompliance.

Key Takeaways

Tests the specific tenant-level setting 'Mark devices with no compliance policy assigned as' which defaults to Compliant but must be changed to Not compliant for strict enforcement.

Learn how to configure Microsoft Intune to mark devices without assigned compliance policies as Not compliant, preventing false positive status reporting.

Common mistake: Many candidates choose option D (modifying actions for noncompliance), mistakenly believing that policy-specific settings can affect devices that are not even targeted by that policy.

Expert Analysis

Why the Answer Is Correct

The correct action is to configure the global compliance policy settings from the Device compliance section. Specifically, you must navigate to Device compliance > Compliance policy settings and change the toggle for "Mark devices with no compliance policy assigned as" from its default value of "Compliant" to "Not compliant." This ensures that any device managed by Intune but not explicitly assigned a compliance policy (like Group1's policy) is reported as Noncompliant.

Why the Other Options Are Wrong

Option D is incorrect because modifying actions for noncompliance within Policy1 only affects devices that are members of Group1 and have violations; it cannot influence the status of devices outside that scope. Option B refers to Endpoint Security and Conditional Access, which govern access grants but do not control the underlying compliance status reporting logic for unassigned devices. Option C involves Diagnostic settings, which are unrelated to compliance state determination.

Community Comment Notes

Community consensus strongly supports Option A. As user Besxp noted, "D only impacts devices targeted by Policy1, not untargeted devices," highlighting the scope limitation of policy-specific actions. User Merrybob provided the official Microsoft Learn reference confirming this setting location. Another commenter clarified that while Endpoint Security leads to the same screen, the primary navigation path is via Device Compliance.

Official Reference

https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with compliance reporting issues, always check if the problem is scope-related (policy assignment) or configuration-related (global settings). If an issue affects unassigned devices, look for global toggles rather than individual policy edits.

Frequently Asked Questions

Why doesn't changing noncompliance actions in Policy1 work?

Policy-specific actions only apply to devices assigned to that policy. Devices not in Group1 are unaffected by Policy1's internal settings.

Where exactly is the 'Mark devices... as' setting located?

It is found under Intune Admin Center > Device compliance > Compliance policy settings. It is a global tenant setting, not per-policy.

More MD-102 FAQ →

Community Votes

A
88%
D
12%

88% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 13 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 13

  1. BJS78 👍 9
    Turn "Mark devices with no compliance policy assigned as" to "Not compliant"
  2. Merrybob 👍 4 Answered A
    A. From Device compliance, configure the Compliance policy settings. Ref: https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started#:~:text=Device%20compliance%20%3E%20Compliance%20policy%20settings
  3. h38jhd38k 👍 3
    https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started
  4. martinods 👍 3
    why not D ?
  5. Merrybob 👍 2
    Ref: https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started#:~:text=Mark%20devices%20with,are%20considered%20noncompliant.
Show 8 more comments
  1. AleFCI1908 👍 2 Answered D
    i think it is D. i think it is the most direct way to mark as not compliant all non compliant devices or devices with no policy
  2. Besxp 👍 1 Answered A
    🔹 The key setting: "Mark devices with no compliance policy assigned as: Compliant / Not compliant" ❗ Why is this setting important? By default, this setting is "Compliant", meaning devices with no assigned policy are still shown as compliant, which leads to false positives in compliance reporting. If you want only devices with a compliance policy assigned to be marked compliant, you must change this global setting to: ✅ "Not compliant" This ensures devices not targeted by Policy1 (e.g., devices not in Group1) are marked Not Compliant. https://learn.microsoft.com/en-us/intune/intune-service/protect/device-compliance-get-started#compliance-policy-settings
  3. RomanV 👍 1 Answered A
    If you use device compliance status with Conditional Access policies, review how your tenant configures the Mark devices with no compliance policy assigned as option, which you manage under Compliance policy settings. https://learn.microsoft.com/en-us/defender-endpoint/minimum-requirements?view=o365-worldwide#supported-windows-versions
  4. ThomasE 👍 1 Answered A
    Was a little confused, because you can also get there by Endpoint Security, Device compliance, Compliance policy settings. Same screen, slightly different way to get there.
  5. Besxp 👍 1
    D only impacts devices targeted by Policy1, not untargeted devices. The issue is outside Policy1's scope.
  6. ergacharsk 👍 1 Answered A
    A. From Device compliance, configure the Compliance policy settings.
  7. sVn01 👍 1 Answered A
    seems correct
  8. MR_Eliot 👍 1 Answered A
    Correct

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Assigning Intune and Cloud PC Roles with Least Privilege

S-grade

SCEP Root Certificate Location for Intune

S-grade

How Many Intune Profiles Are Needed for Cloud PKI User Certificates?

S-grade

What Must Be Purchased First for Intune Device Query at Minimum Cost?

S-grade

Practice All MD-102 Questions

Access 92 questions with complete answers and detailed explanations.

View Full MD-102 Practice Test →

← Back to MD-102 Study Guide