How to Create a Windows 11 Compliance Policy in Microsoft Intune

A Microsoft Intune compliance policy evaluates whether managed Windows devices meet your organization’s security requirements. The resulting compliance status can be monitored in Intune and used with Microsoft Entra Conditional Access.

Before you begin

You need:

• A Microsoft Intune subscription
• Windows devices enrolled in Intune
• Permission to create and assign compliance policies
• Microsoft Entra ID P1 or P2 if the policy will be enforced through Conditional Access

Decide which requirements are mandatory before configuring the policy. Suitable starting controls include BitLocker, Secure Boot, an active firewall, antivirus protection, and a supported Windows version.

Create the policy

1. Sign in to the Microsoft Intune admin center.
2. Open Devices.
3. Under Manage devices, select Compliance.
4. Select Create policy.
5. For Platform, select Windows 10 and later.
6. Select Create.
7. Enter a clear name, such as Windows 11 – Standard Compliance.
8. Add a description explaining the policy’s purpose and intended users.

Configure compliance requirements

Open Compliance settings and expand the available categories. Depending on your security requirements, consider configuring:

• Require BitLocker
• Require Secure Boot
• Require an active firewall
• Require antivirus and antispyware protection
• Set the minimum supported operating-system version
• Restrict simple passwords
• Set an acceptable Microsoft Defender for Endpoint risk level

Avoid enabling every available setting without testing. Some controls depend on Windows editions, hardware capabilities, or other Microsoft security services.

Configure actions for noncompliance

Open Actions for noncompliance. Intune automatically includes an action that marks a device as noncompliant. You can change its schedule or add actions such as:

• Give users a grace period
• Send an email notification
• Lock a device
• Retire a device that remains noncompliant

For a new policy, a short grace period and a user notification are usually more practical than immediately blocking access.

Assign the policy

1. Open Scope tags and apply any administrative scope tags your organization uses.
2. Open Assignments.
3. Select Add groups.
4. Choose a controlled pilot group.
5. Review any exclusions.
6. Select Review + create.
7. Confirm the settings and select Create.

Begin with a pilot group instead of assigning an untested policy across the organization.

Test and monitor the policy

1. Open Company Portal on a test device.
2. Go to Settings.
3. Select Sync.
4. Allow Intune time to evaluate the device.
5. In the Intune admin center, open the compliance policy and review its device and user status.

Investigate settings reported as noncompliant or not applicable before expanding the assignment.

Important distinction

An Intune compliance policy reports device status. It does not automatically block access to Microsoft 365 or other applications. Access restrictions require a separate Conditional Access policy that uses compliant-device status as a condition.

Sources

• Create device compliance policies in Microsoft Intune
• Device compliance settings for Windows in Intune