Why Is This Device Non-Compliant? Per-Device Intune Security Assessment ​

June 15, 2026 · InfraScout Team

Intune is good at telling you a device is non-compliant and quiet about why. The device list shows a red status, but the console doesn't make it obvious which setting tripped it — which compliance policy failed, which configuration profile errored, or which exact registry-level setting is out of bounds. Until now InfraScout could give you the same shape of answer Intune does: it could list managed devices, compliance policies, configuration profiles, and apps, but it couldn't explain a single device's verdict or check its on-device security health. This update closes that gap with a set of read-only tools that drill into one device and tell you, in plain terms, what's wrong and why.

Why is this device failing? ​

When a device shows non-compliant, the question you actually need answered is which policy it failed and which setting drove the failure — the chain that can end in a Conditional Access block keeping the user out of email. InfraScout now walks that chain for a single device, one layer at a time.

Start with the verdict and work down. mscloud_intune_list_managed_device_compliance_states shows which compliance policies a device fails — these are the policies whose results feed Conditional Access, so a failure here is the one that locks a user out. mscloud_intune_get_managed_device_noncompliant_settings then returns the exact individual settings behind that verdict, so "non-compliant" stops being a label and becomes a list of specific things to fix. And because misconfiguration often hides in the profiles meant to harden a device, mscloud_intune_list_managed_device_config_states shows which configuration profiles errored or conflict on that device — the cases where two profiles fight over the same setting, or a profile failed to apply at all.

Read together, these three turn a single conversational question — "why is this laptop non-compliant?" — into a precise answer: this compliance policy failed, because of these settings, and by the way these two configuration profiles are conflicting on the same device.

Start from the device, not the policy

When a user reports they've lost access to email or a corporate app, open the device rather than the policy list. Ask InfraScout which compliance policies the device fails and which settings drove the verdict — that path leads straight to the Conditional Access block, instead of guessing which of a dozen tenant-wide policies applies to this one machine.

On-device security health: antivirus and malware ​

A device can pass every compliance policy and still be in trouble if its protection is switched off or its signatures are weeks stale. InfraScout now reads the on-device security health directly. mscloud_intune_get_managed_device_protection_state returns the Microsoft Defender antivirus posture for a device — whether real-time protection is on, how fresh the signatures are, and where the device is in its scan state — so you can spot a machine that looks managed but is quietly unprotected. mscloud_intune_list_managed_device_detected_malware lists the malware Defender has detected on that device, turning "is this endpoint clean?" into a question you can answer without leaving the assessment.

This is the health check that pairs naturally with the compliance drill-down: a device that fails a compliance policy and has real-time protection disabled is a very different finding from one that fails on a cosmetic naming-convention rule. Reading the two side by side lets you rank what actually matters.

What's actually being pushed: baselines, ASR, and the Settings Catalog ​

The other half of a posture review is the configuration side — not whether a single device passed, but what your tenant is pushing to devices in the first place. A baseline that drifts, an Attack Surface Reduction rule left in audit mode, or a Settings Catalog profile that never got assigned all weaken posture without ever showing up as a device-level failure. InfraScout now reads each of these surfaces directly.

mscloud_intune_list_configuration_policies returns the modern Settings Catalog profiles — the unified configuration surface where most new Intune policy now lives. mscloud_intune_list_group_policy_configurations reads the Administrative Templates (ADMX-backed) profiles, the bridge for organizations that brought Group Policy settings into Intune. And mscloud_intune_list_device_management_intents surfaces Security Baselines, Endpoint Protection, and Attack Surface Reduction template assignments — the templated hardening that often carries the heaviest security weight and is the easiest to leave half-configured.

Together these let an assessment answer the posture-level questions Intune makes you click through tabs to reconstruct: which baselines are assigned and to whom, whether ASR rules are enforcing or merely auditing, and what the Settings Catalog is actually configuring across the fleet.

Seeing the configuration older queries missed ​

The existing mscloud_intune_list_device_configurations tool now sees more than it used to. It can load each profile's assignments — so you know not just that a profile exists but which groups it targets — and it can reach derived-type configuration that older queries couldn't surface at all. A macOS single-sign-on extension configuration, for instance, is a specialized profile type that a plain listing would skip; opting into the newer query surface brings it into view. For platform-specific reviews where the interesting policy lives in these specialized profile types, that's the difference between a complete inventory and one with quiet blind spots.

Every tool here is read-only. None of them change anything on a device or in your tenant — they read state, the same way the rest of an InfraScout assessment does. Just as importantly, they need no new admin consent. These tools are covered by the Intune device-management read permissions InfraScout's app already holds, so existing customers don't need to re-run provisioning or grant anything new to start using them. Open an assessment and the per-device drill-down is simply there.

Assessment, not administration

Destructive device actions — wipe, retire, reboot, remote lock — are deliberately out of scope. InfraScout is an assessment platform: it explains what's wrong and why, then hands you the finding. The remediation happens in your management tooling, with your change controls, not from a chat prompt.

Try it ​

Open an Intune assessment and start from a device that's showing non-compliant. Ask InfraScout why it's failing — which compliance policies it fails, which settings drove the verdict, and whether any configuration profiles are erroring or conflicting on it. Then check its security health: is Defender real-time protection on, are the signatures current, has anything been detected? Widen out to the posture review — pull the Security Baselines and ASR assignments, list the Settings Catalog and Administrative Templates profiles, and confirm the profiles you think are deployed are actually assigned to the right groups. The complete set of Intune tools lives in the Microsoft Cloud — Services tool reference.

Questions or feedback? Reach us at info@infrascout.cloud.