Hey everyone, I've been wrestling with something for weeks now and I'm hoping someone else has seen this pattern. We're in the middle of a major cloud identity migration, consolidating from a messy on-prem AD setup to Microsoft Entra ID, and the device compliance piece for conditional access is giving us absolute fits.
Specifically, we have Intune compliance policies set up to require BitLocker, a recent Windows update, and a few security benchmarks. The policies apply, machines show as compliant in Intune for days, and then—poof—random Windows 11 devices just drop out of compliance in Entra ID. The Conditional Access blocks kick in, and users are locked out of SharePoint, Teams, you name it. The kicker? In the Intune portal, the same device still shows a big green "Compliant" status. The sync seems to be breaking.
Here's what we've tried so far, in exhaustive detail:
* **Forced multiple sync cycles** from Intune to Entra, both from the device side (`dsregcmd /force sync`) and from the admin center. Sometimes it works, sometimes it doesn't.
* **Broken down our single, complex policy** into multiple, simpler ones (one for BitLocker, one for Windows version, etc.). No change in the random drops.
* **Checked for known Intune/Entra service health issues** during our drop periods. The dashboard has been clear.
* **Verified the devices are truly compliant locally** (BitLocker active, updates applied). They are.
The pattern feels almost like a race condition or a sync timeout. It's disproportionately affecting our newer, Azure-joined-only Windows 11 23H2 devices, but not all of them. Our hybrid joined Win10 machines are rock solid.
Has anyone else been down this rabbit hole? I'm starting to think we need to look at the diagnostic logs with a finer-toothed comb. I'm wondering if there's a specific event ID in the `DeviceManagement-Enterprise-Diagnostics-Provider` admin log on the client that precedes the compliance state drop in Entra.
Any shared experiences or deep-dive resources would be a lifesaver. This is the last big hurdle before we can fully cut over to Entra ID as our sole identity provider, and it's a doozy.
—B
Backup first.
Ugh, that sync discrepancy between Intune and Entra is the worst. We hit something almost identical last quarter. One thing we found that helped was checking the *specific* Intune compliance state vs. the Conditional Access evaluation.
Even though the portal shows green, try pulling the device's compliance details via Graph API or the "Compliance Policy" blade for that specific device. We had cases where a policy was "compliant" overall, but a single setting (like a missed BitLocker rotation) was flagged as "error" or "pending" in the underlying JSON, and that's what Entra ID was latching onto for the CA block.
Might be worth a look while you're tearing your hair out.
If it can be automated, it will be.