Intune Compliance Policy and CrowdStrike

Question

We have a hand full of devices that are hybrid joined and enrolled in Intune. I would like to create a compliance policy that checks to make sure our AV CrowdStrike is installed and if possible the device has the most recent Windows Security Updates installed. Creating a custom compliance policy for CrowdStrike has returned a number of helpful articles online. The custom scripts seem to also want a configuration JSON file as well in the portal but I do not see any mention to it in some of the articles I have read. I have not used custom compliance polices before so any guidance will be greatly appreciated.

https://www.reddit.com/r/Intune/comments/11ynzxc/custom_compliance_policies_for_crowdstrike_av_and/

https://learn.microsoft.com/en-us/mem/intune/protect/crowdstrike-falcon-mtd-connector-integration

Answer 1

@rr-4098 Thanks for posting in our Q&A.

In our official article, it shows that "Before you can add custom settings to a policy, you must prepare a JSON file, and a discovery script for use with each supported platform. Both the script and JSON become part of the compliance policy." Here is the link:

https://learn.microsoft.com/en-us/mem/intune/protect/compliance-use-custom-settings

The JSON file defines the custom settings and the values that you considered to be compliant. Here is an example of JSON file:

https://learn.microsoft.com/en-us/mem/intune/protect/compliance-custom-json

Discovery scripts are specific to the different platforms and are delivered to devices as part of the compliance policy. When a device evaluates its policy, the script detects (discovers) the settings from the JSON file, and then reports the results to Intune.

https://learn.microsoft.com/en-us/mem/intune/protect/compliance-custom-script

Hope it will give you some ideas.

---

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.