Compliance
The Compliance page checks the policies MDO collected from a tenant against a standard, control by control. It makes no changes to the tenant and needs no agent on devices.
Open it from Compliance in the sidebar. The older CIS Compliance page is still reachable from More › Old CIS page.
Standards
Section titled “Standards”Pick a standard at the top of the page.
| Standard | Levels | Scored |
|---|---|---|
| CIS v5: CIS Microsoft Intune for Windows 11 v5.0.0 | Level 1, Level 2 (includes Level 1), BitLocker, All | Yes |
| Essential Eight | ML1, ML2, ML3, All | Maturity level per strategy |
| Microsoft baselines: Windows 25H2, Defender for Endpoint 24H1, Edge 139, Microsoft 365 Apps 2512 | One baseline at a time | Not yet; controls are checked now |
Scores
Section titled “Scores”For CIS v5 the score header shows:
- Strict: controls enforced out of controls scored, as CIS wrote them.
- With exceptions: the same, counting your recorded exceptions as met.
- MDO Hardening: counts MDO’s accepted deviations as met. MDO deviates from CIS on a set of rules, mostly so Autopilot keeps working, and shows each one as Accepted deviation.
- On devices, when device results exist: the share of in-scope devices where each control applied.
- A 90-day trend.
For the Essential Eight, each strategy gets a tile with the maturity level achieved, and the tenant’s level is the lowest across the strategies MDO assesses. MDO assesses six. Multi-factor authentication and regular backups are outside Intune and listed as not checked. Where a tile says Maturity levels not yet confirmed against ASD, the level assignments for that strategy still need checking against the ASD’s mapping.
Every score states its scope, for example “CIS v5 L1 on 42 corporate Windows devices”.
Control states
Section titled “Control states”| State | Meaning |
|---|---|
| Enforced | An assigned policy sets the right value for everyone in scope. |
| Partial | The right value, assigned to some groups only, or narrowed by exclusions or filters. |
| Staged | The right value is in a policy that isn’t assigned. |
| Wrong value | An assigned policy sets a value that doesn’t meet the control. |
| Conflicting | Two policies that can reach the same devices set different values. |
| Not configured | No assigned policy sets it. |
| Accepted deviation | MDO deliberately departs from the benchmark here. |
| Manual | Intune can’t show it; check it by hand and attest. |
| Not applicable | Doesn’t apply to Entra-joined Windows devices. |
| Error | MDO couldn’t evaluate it; the reason is shown. |
Exception, Attested: met and Attested: not met show on top of the state.
In policy and On devices
Section titled “In policy and On devices”Click a control to open it.
In policy names each policy that sets the control, the value it sets, and its assignment, including include and exclude groups and assignment filters. Links open the policy in MDO’s policy viewer or in Intune.
On devices reads Intune’s own device reports for those policies. It reads, for example: Delivered to 39 of 42 in-scope devices by a policy that meets the control; conflict 1, no report yet 2. This is Intune’s report of delivery. MDO doesn’t read the value on the device. Show devices lists them, and Load the setting detail (admins) fetches Intune’s per-setting report when a conflict needs explaining. Device results refresh with the nightly collection or Scan now.
Controls delivered by remediation scripts have no device results. For compliance policy controls, a device marked not compliant isn’t confirmed setting by setting.
Open Settings › Compliance scope, or Change scope on the page. Each standard has its own scope:
- Default: Intune-managed corporate Windows devices.
- The devices in an Entra group. MDO reads the group’s members, which takes a few minutes the first time.
- The devices an assignment filter matches. MDO evaluates the filter rule itself. A rule it can’t evaluate is refused with the reason.
Changes are audit-logged, and the tenant is rescanned straight away.
Exceptions
Section titled “Exceptions”On a control you don’t intend to meet, click Record an exception. You give a reason and an approver, and an expiry date: 12 months by default, three years at most. The strict score still counts the control as not met, and the With exceptions score counts it as met. Exceptions appear in the CSV and the printable view. Only Admins and Owners can record them.
Attestation
Section titled “Attestation”On a Manual control, Attest this control records it as met or not met with a note or a link to evidence. MDO asks for a review after 90 days by default, then returns the control to Manual. Only Admins and Owners can attest.
Other tabs and exports
Section titled “Other tabs and exports”- Hygiene: 33 tenant checks that aren’t part of any standard and aren’t scored.
- Not checked by MDO: the controls in the standard that MDO can’t assess from Intune.
- Download CSV and Printable view (PDF) from the Export menu beside the score.
- From Intune › Devices, See this device’s compliance opens one device across the controls.
Admins can start a scan with Scan now. Otherwise the scan runs after each collection.