Pilot an Intune Windows Device Compliance Policy

An Intune compliance policy evaluates whether an enrolled device meets your organization’s requirements. This walkthrough checks BitLocker and Secure Boot on a small Windows pilot. The policy reports compliance; it does not turn on encryption or configure the device settings for you.

Keep the assignment limited to a test group

Assign the policy only to approved pilot devices or users. Confirm that each device supports the selected requirements and already meets them, or has a separate approved configuration plan. A device marked noncompliant can lose access if a Conditional Access policy uses that status.

BitLocker compliance is based on device health attestation

Intune’s BitLocker compliance check is measured at boot. If BitLocker has just finished encrypting a device, restart it and allow the next check-in before treating a stale result as a policy failure.

01

Confirm Enrollment and Device Readiness

Preflight

Use an enrolled Windows 11 test device with a known primary user and a recent Intune check-in. In an elevated PowerShell session on that device, inspect BitLocker and Secure Boot before assigning requirements. Confirm-SecureBootUEFI applies to supported UEFI devices; if the command is unavailable on the test hardware, confirm platform support with your device owner.

Get-BitLockerVolume -MountPoint $env:SystemDrive |
  Select-Object MountPoint, VolumeStatus, ProtectionStatus, EncryptionPercentage

Confirm-SecureBootUEFI

❯ Illustrative Output (Results Vary)

MountPoint VolumeStatus   ProtectionStatus EncryptionPercentage
---------- ------------   ---------------- --------------------
C:         FullyEncrypted On               100

True

Use an approved BitLocker configuration process

If BitLocker is off, this compliance policy will report that the requirement is unmet; it will not start encryption. Use your organization’s approved Intune endpoint security or BitLocker configuration policy, confirm recovery-key escrow, and then recheck the device.

---

02

Create a Windows Compliance Policy

Policy Setup

In the Microsoft Intune admin center, go to Devices > Compliance > Policies > Create policy. Select Windows 10 and later as the platform; this is the current Intune platform label for supported Windows 11 devices too. Name the policy clearly, for example WIN-Pilot-BitLocker-SecureBoot, and add a description that identifies the pilot scope.

Platform: Windows 10 and later
Policy name: WIN-Pilot-BitLocker-SecureBoot
Description: Evaluate BitLocker and Secure Boot on the Windows pilot group

❯ Illustrative Output (Results Vary)

The policy wizard opens with the Windows compliance settings for the selected platform.

---

03

Choose the Requirements to Evaluate

Compliance Settings

On the Compliance settings tab, expand Device health. Set Require BitLocker to Require and Require Secure Boot to be enabled on the device to Require. Leave unrelated settings at Not configured for this focused pilot unless your approved baseline requires them.

Device health
  Require BitLocker: Require
  Require Secure Boot to be enabled on the device: Require

Other settings: Not configured for this focused pilot

❯ Illustrative Output (Results Vary)

The policy evaluates only the two requirements selected for this pilot.

---

04

Assign Only the Approved Pilot Group

Assignment

On Assignments, include the approved pilot group that matches your enrollment model. Confirm its members and avoid broad production groups during the test. Review Actions for noncompliance and make sure the timing and any user notifications match your organization’s approved policy before creating the compliance policy.

Included group: WIN-Intune-Compliance-Pilot (example name only)
Assignment scope: approved pilot users or devices
Actions for noncompliance: reviewed against the change plan

❯ Illustrative Output (Results Vary)

Only the intended pilot receives this compliance evaluation.

---

05

Sync the Test Device and Allow Evaluation

Device Check-In

On the test device, open Start > Settings > Accounts > Access work or school, select the work account, choose Info, then select Sync. You can also sync from the Company Portal app’s settings. Allow the device to check in and the compliance reports to refresh; a manual sync does not guarantee that every status changes immediately.

Windows Settings > Accounts > Access work or school
  > select the connected work account > Info > Sync

Optional: Company Portal > Settings > Sync

❯ Illustrative Output (Results Vary)

Confirm the device sync completes, then allow time for Intune to report the evaluation.

---

06

Review the Device's Compliance Details

Validation

In Intune, open Devices > Compliance > Monitor and review the device compliance status or noncompliant devices report. Open the test device and inspect its policy and individual setting results. If a result is stale, confirm the last check-in and assignment, sync again, and for a recently encrypted BitLocker volume restart the device before reevaluating.

Intune admin center > Devices > Compliance > Monitor
  > Device compliance status or Devices without compliance
  > select the test device > review the policy and setting details

❯ Illustrative Output (Results Vary)

Record the device, policy, failed or pending setting, last check-in, and corrective action.
Expand assignment only after the pilot results match the approved baseline.

Compliance evaluates state; configuration policies change it

Use a separate approved configuration or endpoint security policy to enable BitLocker or change device settings. If you later use device compliance in Conditional Access, that integration requires Microsoft Entra ID P1 or P2 and should be piloted separately.

Upstream references

See Microsoft’s Intune compliance policy creation guide, Windows compliance settings reference, monitor compliance results guide, Windows device sync guide, and endpoint security policy guide.