AD3.7 Handling Non-Compliant Devices

The helpdesk remediation script

When a user calls because they're blocked from M365 access, the helpdesk follows this script:

Step 1 — Identify the device. Ask the user for their device name or username. Navigate to intune.microsoft.com → Devices → All devices → search by name or user. Open the device page.

Step 2 — Check compliance status. Click "Device compliance." This shows each compliance check with pass/fail status. Identify which check(s) are failing.

Step 3 — Follow the specific remediation for the failing check:

For BitLocker not enabled: Verify the BitLocker configuration profile (AD3.6) is assigned to this device. If assigned, trigger a device sync from Intune (Device page → Sync). The device should start encrypting on next check-in. If the profile isn't assigned, add the device to the assignment group. Tell the user: "Your laptop needs to encrypt its hard drive. This happens automatically — you'll see a notification. It may take 1-2 hours. Your laptop will continue working during encryption. You'll need to restart once."

For OS version too old: Check the current OS version in the device properties. If one version behind, the user can update via Settings → Windows Update → Check for updates. If multiple versions behind, the update may take longer — schedule it during lunch or end of day. Tell the user: "Your laptop needs a Windows update. Please go to Settings → Windows Update → Check for updates. The update will require a restart. Expect 30-60 minutes."

For Firewall disabled: This is unusual — most users don't know how to disable the firewall. Remote-assist the user to re-enable it: Settings → Privacy & Security → Windows Security → Firewall & network protection → enable for all profiles. Or use PowerShell remotely via Intune:

Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True

Investigate why it was disabled. If the user disabled it "because the VPN didn't work," the VPN configuration needs fixing — the firewall shouldn't be the workaround.

For Antivirus not active or signatures stale: Check if a third-party AV is installed (it may have disabled Defender). If no third-party AV: open Windows Security → Virus & threat protection → Turn on real-time protection. Run "Update" to refresh signatures. If third-party AV exists: verify it's reporting to Windows Security Center. Some third-party AV products require a configuration change to integrate with Intune compliance checks.

Step 4 — Trigger compliance re-evaluation. After remediation, the device needs to check in with Intune for the compliance state to update. From the device page in Intune, click "Sync." The compliance state typically updates within 15-30 minutes. Tell the user: "Please try accessing email again in 15-30 minutes. The security check needs to verify your device is now compliant."

Step 5 — Verify access restored. After the compliance state updates to "Compliant," the user should be able to access M365 normally. If they're still blocked after the device shows compliant, the compliance state may not have propagated to Entra ID yet — this can take up to 2 hours. In most cases, a sign-out and sign-back-in forces a fresh conditional access evaluation.

Remote remediation for off-site users

Users who are traveling or working remotely can't bring their laptop to the helpdesk. Remote remediation requires different tools.

Intune remote actions. Navigate to intune.microsoft.com → Devices → select the device. The device page offers several remote actions: Sync (forces immediate policy check-in), Restart (triggers pending updates), and Collect diagnostics (retrieves device health data). Use Sync first to trigger a compliance re-evaluation after the user has remediated on their end.

PowerShell remoting. If the device is connected to the network and you have admin access, use PowerShell remoting to check and fix compliance issues:

# Check BitLocker status remotely
Invoke-Command -ComputerName "DESKTOP-NGE042" -ScriptBlock {
    Get-BitLockerVolume -MountPoint "C:" |
        Select-Object MountPoint, VolumeStatus, EncryptionPercentage, ProtectionStatus
}

# Check Defender status remotely
Invoke-Command -ComputerName "DESKTOP-NGE042" -ScriptBlock {
    Get-MpComputerStatus |
        Select-Object RealTimeProtectionEnabled, AntivirusSignatureAge,
            AntivirusSignatureLastUpdated, AMServiceEnabled
}

# Force Defender signature update remotely
Invoke-Command -ComputerName "DESKTOP-NGE042" -ScriptBlock {
    Update-MpSignature
}

# Check and enable firewall remotely
Invoke-Command -ComputerName "DESKTOP-NGE042" -ScriptBlock {
    Get-NetFirewallProfile | Select-Object Name, Enabled
    Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
}

Company Portal self-service. The Company Portal app (installed on managed devices) shows users their compliance status with actionable guidance. Navigate the user to Company Portal → Device compliance. Each failing check shows a description and a "Resolve" button that takes the user to the relevant system setting. For common issues (Windows Update needed, firewall disabled), the Company Portal provides enough guidance for users to self-remediate without calling the helpdesk.

Communicate the Company Portal self-service option during your enforcement announcement: "If your device is non-compliant, open the Company Portal app on your laptop and check the Device Compliance section. It shows exactly what needs fixing and links directly to the setting. For most issues, you can resolve it in 5 minutes without calling the helpdesk."

Tracking remediation metrics

After the first month of enforcement, track two metrics: average time from non-compliant to remediated (target: under 24 hours), and helpdesk tickets related to compliance (target: decreasing each month as users learn to self-remediate). These metrics tell you whether your remediation process is working and whether the helpdesk load is sustainable.

Using Intune Remediation Scripts for automated fixes

For recurring compliance failures that have simple, scriptable fixes, deploy Intune Proactive Remediations (now called Remediation scripts). These scripts run on a schedule, detect the problem, and fix it automatically — without helpdesk involvement.

Navigate to intune.microsoft.com → Devices → Remediation → Create script package.

Example: Auto-re-enable Windows Firewall

Detection script (checks if firewall is disabled):

# Detection: Check if any firewall profile is disabled
$profiles = Get-NetFirewallProfile
$disabled = $profiles | Where-Object { $_.Enabled -eq $false }
if ($disabled) {
    Write-Output "Firewall disabled on profile: $($disabled.Name -join ', ')"
    exit 1  # Non-compliant — trigger remediation
} else {
    Write-Output "All firewall profiles enabled"
    exit 0  # Compliant — no action needed
}

Remediation script (re-enables firewall):

# Remediation: Re-enable all firewall profiles
Set-NetFirewallProfile -Profile Domain,Public,Private -Enabled True
Write-Output "All firewall profiles re-enabled"
exit 0

Set the script to run every 8 hours. If a user or application disables the firewall, the remediation script detects it within 8 hours and re-enables it automatically. The device returns to compliance without any human intervention.

You can build similar remediation scripts for other compliance issues: re-enabling Defender real-time protection, forcing signature updates when signatures are more than 3 days old, and triggering Windows Update checks when the OS version falls behind. Each script reduces helpdesk ticket volume and keeps devices compliant automatically.

When remediation requires physical access

Some compliance failures can't be fixed remotely. A device with no TPM chip can't enable BitLocker without hardware modification. A device with a failed hard drive needs physical repair. A device running Windows 10 on hardware that doesn't meet Windows 11 requirements needs replacement.

For these cases, escalate to the hardware procurement process. Document in the exception register (AD3.8) with a hardware replacement date. In the meantime, apply the strongest alternative control available — typically network-restricted access via CA named locations. The device continues to function from the office network while the replacement is ordered and deployed.