Rules/INT-001.compliance-policy-assigned.psd1

@{
    Id          = 'INT-001'
    Title       = 'At least one device compliance policy exists and is assigned'
    Area        = 'IntuneCompliance'
    Severity    = 'Medium'
    References  = @(
        'https://learn.microsoft.com/intune/intune-service/protect/device-compliance-get-started'
    )
    Rationale   = 'Without an assigned compliance policy every device counts as compliant by default - Conditional Access device-compliance grants become meaningless.'
    Remediation = 'Create compliance policies per platform (encryption, OS version, lock) and assign them to all managed devices.'
    Test        = {
        param($Snapshot)
        $policies = @($Snapshot.IntuneCompliance.policies)
        $assigned = @($policies | Where-Object { @($_.assignments).Count -gt 0 })
        if ($assigned.Count -gt 0) {
            New-TLRuleResult -Status Pass -Evidence @($assigned | ForEach-Object { $_.displayName })
        }
        elseif ($policies.Count -gt 0) {
            New-TLRuleResult -Status Fail -Evidence ("{0} compliance policies exist but none is assigned." -f $policies.Count)
        }
        else {
            New-TLRuleResult -Status Fail -Evidence 'No device compliance policies exist.'
        }
    }
}