Rules/INT-008.no-noncompliant-devices.psd1
|
@{ Id = 'INT-008' Title = 'No managed devices are non-compliant' Area = 'ManagedDevices' Severity = 'Medium' References = @( 'https://learn.microsoft.com/intune/intune-service/protect/device-compliance-get-started' ) Rationale = 'A non-compliant device is one Intune is actively evaluating and failing - unpatched, unencrypted or misconfigured while still holding corporate data and tokens. Conditional Access device-compliance grants only help if devices are actually compliant.' Remediation = 'Investigate the non-compliant devices, remediate the failing settings, and ensure a compliance policy is assigned so the state is meaningful (see INT-001/INT-004).' Test = { param($Snapshot) $summary = $Snapshot.ManagedDevices.summary if (-not $summary -or -not $summary.PSObject.Properties['nonCompliantCount']) { return New-TLRuleResult -Status Manual -Evidence 'Device compliance counts not present in the snapshot.' } $nonCompliant = [int]$summary.nonCompliantCount if ($nonCompliant -eq 0) { New-TLRuleResult -Status Pass -Evidence ("All {0} managed devices are compliant." -f $summary.total) } else { $examples = @($Snapshot.ManagedDevices.devices | Where-Object { [string]$_.complianceState -eq 'noncompliant' } | Select-Object -First 10 | ForEach-Object { "$($_.deviceName) ($($_.operatingSystem))" }) New-TLRuleResult -Status Fail -Evidence (@("{0} of {1} managed devices are non-compliant." -f $nonCompliant, $summary.total) + $examples) } } } |