{
  "totalDevices": 5,
  "compliantDevices": 3,
  "complianceRate": 0.6
}

Device Compliance Rate

What this checks

The proportion of Intune-managed devices that are in a compliant state against at least one assigned compliance policy. E8 ML1/ML2 requires ≥ 90 % compliance; below that the control is partial; zero managed devices means the control is not assessable via this API.

Remediation

• Enrol all endpoints in Microsoft Intune via Entra ID join or hybrid join for Windows, and automated device enrolment (ADE) for macOS/iOS.
• In Intune > Devices > Compliance policies, create platform-specific policies covering: OS version minimums, BitLocker/FileVault encryption, antivirus status, firewall enabled, and screen lock timeout.
• For non-compliant devices, review the non-compliance reason in Intune > Devices > [device name] > Device compliance — common causes include outdated OS, disabled firewall, or pending encryption.
• Configure compliance grace periods so that newly enrolled devices have time to remediate before being blocked, but keep the period short (≤ 24 hours).
• Use Conditional Access to enforce device compliance as a grant condition so that non-compliant devices cannot access corporate resources.

{
  "totalPolicies": 2,
  "policiesWithMinVersion": 2
}

Minimum OS Version Policy

What this checks

Whether at least one Intune device compliance policy includes a minimum OS version requirement for Windows or macOS endpoints. The presence of such a policy signals that the organisation is enforcing a patching baseline.

Remediation

• In Intune > Devices > Compliance policies, create or edit platform compliance policies.
• For Windows 10/11: under System Security, set Minimum OS version to the current N-1 supported build (e.g., the most recent feature update minus one). ACSC recommends patching within 48 hours for internet-facing systems and within one month for workstations.
• For macOS: under Device Health, set Minimum OS version to the current N-1 macOS release.
• Pair the compliance policy with a remediation script (Intune Remediations) that triggers Windows Update for devices that fall below the minimum version.
• Review and update the minimum version requirement after each Patch Tuesday cycle to keep the baseline current.

Note: This check can only verify that a minimum-version _policy exists_, not that patches were applied within a specific time window. Manual evidence (Windows Update for Business reports, WSUS logs) is required to demonstrate the ACSC 48-hour/1-month patching cadence.