Rules/INT-001.compliance-policy-assigned.psd1
|
@{ Id = 'INT-001' Title = 'At least one device compliance policy exists and is assigned' Area = 'IntuneCompliance' Severity = 'Medium' References = @( 'https://learn.microsoft.com/intune/intune-service/protect/device-compliance-get-started' ) Rationale = 'Without an assigned compliance policy every device counts as compliant by default - Conditional Access device-compliance grants become meaningless.' Remediation = 'Create compliance policies per platform (encryption, OS version, lock) and assign them to all managed devices.' Test = { param($Snapshot) $policies = @($Snapshot.IntuneCompliance.policies) $assigned = @($policies | Where-Object { @($_.assignments).Count -gt 0 }) if ($assigned.Count -gt 0) { New-TLRuleResult -Status Pass -Evidence @($assigned | ForEach-Object { $_.displayName }) } elseif ($policies.Count -gt 0) { New-TLRuleResult -Status Fail -Evidence ("{0} compliance policies exist but none is assigned." -f $policies.Count) } else { New-TLRuleResult -Status Fail -Evidence 'No device compliance policies exist.' } } } |