Does Intune Machine Risk Score include other items, if all listed show as compliant

Question

Our computers are set to "medium" for compliance in Intune/MEM. All the items in the list show as compliant but computer shows as non-compliant. Are there other items that are taken under advisement that we can't see on this screen that contribute to the score.

Answer 1

Hi @Tom Sweet Thanks for posting in our Q&A.

Firstly, Check Intune -> Devices -> Azure AD devices
"Join Type" make sure that it shows up as "Azure AD joined" instead of "Azure AD registered".
You'll need a Microsoft Intune environment, with Intune managed and Azure AD joined Windows 10 and Windows 11 devices. As documented here:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/configure-conditional-access?view=o365-worldwide

Please try to run a test detection for Defender ATP for any of the machines experiencing this issue. See:
https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/run-detection-test?view=o365-worldwide
Hope the above workaround can help.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Thank you - I will look over the coming days. We are struggling to get some computers moved from a local AD with AD-registered to AD joined. It is almost like we need to disconnect from local AD, add back again. I will reply more next week.

Answer 3

Thank you - I will look over the coming days. We are struggling to get some computers moved from a local AD with AD-registered to AD joined. It is almost like we need to disconnect from local AD, add back again. I will reply more next week.

Answer 4

I think the issue may be "registered vs joined." We are having some challenges getting computers to be "joined." About 2/3 company machines are registered. We can't always find the "join" link and often we run into issues were we can't join as it is registered.

We also have over a dozen computers with two values in Azure Portal Devices. The current device as the manage button enabled, but no bitlocker key. The older instance with the managed button disabled as the actual bitlocker key.

Most users are remote, and travel. Often Quick Assist won't won't work from McDonald's wifi.

I looked at a non-compliant computer today and it is "registered", not joined.