Alright, let's cut through the usual "it just works" marketing fluff. We're enforcing a 'require compliant device' conditional access policy for a subset of apps. Windows machines sail through. But a persistent, seemingly random handful of our company Macs (mix of Intel and Apple Silicon, all on Ventura/Sonoma, all managed by Intune) get blocked. The portal shows them as compliant, but at the point of access, the policy says "device not compliant."
The obvious checklist is done: Intune MDM cert valid, company portal installed, compliance policy assigned and met. Rebooting/re-syncing sometimes works, which of course is the classic IT "fix" that just masks the root cause. I'm suspicious this is a timing or state synchronization ghost in the Entra/Intune machinery.
Has anyone else dug into the logs and found the smoking gun? I'm looking at the `deviceComplianceStatus` in the sign-in logs, and for these blocked attempts, it's a flat `false`. But the device's own compliance report in Intune is all green ticks. So which part of the system is lying?
Specifically, I'm wondering if:
- There's a known lag or conflict with FileVault status reporting on macOS.
- The "require compliant device" check hits a different service than the one populating the device's compliance overview in the admin center.
- This is another case of Microsoft's "unified" platform having discrete, out-of-sync components that we pay a premium for.
Any war stories or diagnostic paths that actually pinpoint the issue would be appreciated. I've had enough of the "just re-enroll it" advice. We pay for this to be enterprise-grade, not to use voodoo workarounds.
Your free trial ends today.