What you’re seeing
- Intune lists the device as "Not compliant" even though encryption, antivirus and updates all appear to be in place.
- The user is blocked from Outlook, Teams or SharePoint with a message that the device must meet the organization's requirements.
- Company Portal shows a vague reason such as "Unable to check status" or a setting that seems correct on the device.
- The device flips between compliant and non-compliant from one day to the next.
Common causes
Every environment is different, but these are the causes our engineers find most often:
- A compliance setting checks something more specific than it appears, such as BitLocker through device health attestation or a minimum OS build number.
- The device has not reported its status recently, so Intune marks it non-compliant by default after the grace period.
- Microsoft Defender or another security product is reporting its state differently from what the compliance policy expects.
- Duplicate or stale device records in Entra ID mean the record Conditional Access sees is not the one that is actually healthy.
- The built-in policy that requires an active user or a recent check-in is failing for shared or rarely used devices.
- Secure Boot or TPM settings are off in the firmware, causing health attestation checks to fail.
Why it matters
A false non-compliant status locks real people out of email and files, often first thing in the morning or right before a deadline. The pressure to restore access quickly tempts admins to exclude users from Conditional Access or switch policies to report-only mode, which can leave the organization without protection long after the original problem is forgotten. For businesses that must demonstrate device controls to auditors or cyber insurers, inaccurate compliance data is a problem in its own right.
How AskTechGurus fixes it
Skip the trial and error. A certified engineer works on your actual system, finds the root cause, and fixes it properly.
Tell us what’s happening
Submit a ticket in about two minutes. Paste the error, describe what changed, and pick your tier. No charge to submit.
A certified engineer diagnoses it
A vetted, US-based systems engineer claims your ticket, usually within minutes during business hours, and investigates over a secure remote session you can watch and end at any time.
Fixed and verified with you
The engineer resolves the root cause and confirms with you that it’s working. You don’t just get a workaround, and you get a plain-English summary of what was wrong.
Pay only when it’s resolved
Fixed price from $99, invoiced only after you approve the fix. If it isn’t resolved, you don’t pay.
Frequently asked questions
Can we just exempt this user from the policy for now?
An exemption restores access but removes protection for that account, and temporary exemptions are often forgotten. We look for the real compliance failure so access is restored without weakening your policies.
Why does Intune disagree with what we see on the device?
Compliance checks often test a specific technical condition, such as how encryption was enabled or whether the device recently reported in, rather than what is visible on screen. Finding the exact failing check is the key to resolving it.