Device compliance policy fails - Is active - Not compliant

Question

Hi, I wonder if someone have experienced the same issue or have a clue where to start troubleshooting.

Entra joined computers suddenly stop reporting to Intune, sync fails and computer naturally becomes non-compliant due to policy. The only compliance policy that computers fail - "Is active".

Upon investigation, I can see that on computers scheduled tasks fail that are located at \Microsoft\Windows\EnterpriseMgmt\ and if we can catch the problem in time - forcing sync from Company portal helps. But if more time passes, computers cannot sync anymore and we use scripts to manually push the sync like this: https://walidrahoui.com/en/manually-restart-the-enrollment-of-a-windows-10-machine-in-intune-without-losing-the-configuration-and-the-azure-ad-join/

It seems pretty random as even the script does not help anymore and I have not noticed any logic in what computers are affected. Computers also fall out of Intune if they are not active long enough.

Answer 1

@ArchiMe,Thanks for posting in Q&A.

From your description, I know that the device failed to sync with Intune and computer became non-compliant due to policy.

To clarify this issue, please check things below:

1.Check if there exist Conditional Access blocking non-compliant device sync with Intune.

2.The non-compliant device may have issue syncing with Intune. Please unassign the compliance policy and try to sync with Intune.

3.Please provide us computer scheduled failed message.

4.Please check if exist related message in Event Viewer > Applications and Services log > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin

5.Go to Intune admin center and check Compliance policy settings.

6.The dmwappushservice service is required on client devices for Intune management. If this service is disabled, the device can't sync with Intune. Check whether the dmwappushservice service Startup type is Automatic.

https://learn.microsoft.com/en-us/troubleshoot/mem/intune/device-management/cannot-sync-windows-10-devices

Please check above information, if there is any update, feel free to contact me.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

Hi,

Thank you for answer,

1. I checked and do not see any conditional access policy that could cause this behavior.
2. We should check that, but not sure if we can turn this off for whole org.
3. Including a picture, sorry it is not in English, but codes are there.

1. It has mostly information and some of these:
   MDM Session: OMA-DM message failed to be sent. Result: (Bad request (400).).
2. This compliancy setting is turned so computers are not compliant after 30 days and it is on purpose. I should check, but do not think we can allow it. Can it prevent sync?
3. dmwappushservice we checked already and it is Automatic, we tried to change it and restart, no effect.

Any ideas where I can dig to determine the root cause?