Azure AD shows device compliance as "NA" while intune shows it as compliant

Stanislaw Koltschin 6

For all our Azure AD registered devices Azure AD shows their compliance (property isCompliant) as N/A, even though in Intune they show up as compliant.
Ony Android, iOS or Windows Autopilot devices reflect the compliance correctly.
All the BYOD / Azure AD registered devices, regardless if registered via Company Portal App or Work Account connect, show up as N/A.

Any ideas how we can fix that?

That attribute isCompliant is important for conditional access rules etc.

Best regards

Stan

JamesTran-MSFT 36,606 Reputation points Microsoft Employee

2022-08-11T21:10:50.627+00:00

@Stanislaw Koltschin
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

3 answers

Reinhard Schwarz 11 Reputation points

2024-03-12T18:19:46.3+00:00

I am facing exactly the same situation, Microsoft 365 E3 with Intune license assigned to users, Intune device compliance policies all green at the devices in question, devices onboarded through Company Portal which displays "Compliant", work profile successfully created and devices synchronized multiple times over multiple days but still: Devices are marked incomplete in Entra ID, no MDM linked and Compliance field still N/A.

There's solely Intune configured as MDM, MDM user scope is assigned to one group containing all internal employees with E3 license assigned, no WIP user scope used.

Really frustrating because Conditional Access Policies keep failing as we require compliant devices to access our resources thus our users are locked out.

Are there any news on this issue, is there a fix available, can we expect further investigation at Microsoft?

Thanks!
Please sign in to rate this answer.

1 person found this answer helpful.
Tim J 5 Reputation points

2024-03-13T13:30:19.09+00:00

We're dealing with the same exact issue and I'm stumped. It's happening to 2 devices of ours (out of 400+). I have tried numerous things to get these two devices correctly on Azure. I have tried:

Disjoining and rejoining on Azure AD

Leaving and rejoining the domain Clearing all remnants of the device - on-prem AD and Azure AD

There is nothing different about these 2 devices from our 400+ devices. What is going on with this and will Microsoft help us out?

MDM will say "None" and Complaint is "N/A"

Rudy Ooms 611 Reputation points MVP

2024-03-13T13:42:49.29+00:00

Mdm = none … the device needs to be enrolled into intune to be able to pass the compliance state… so i would start there… there must be something mentioned in the event logs about this

Tim J 5 Reputation points

2024-03-14T12:27:44.8766667+00:00

@Rudy Ooms Thank you! You are exactly right.

Normally a device automatically becomes enrolled in Intune via our GPO, but something happened with 2 of our devices. Some "hiccup", I would guess.

This might help the OP, too, but again, thank you Rudy because you led me to the discovery of the "Company Portal" app by Microsoft. I guess in the future, Microsoft is going to require us to utilize "Company Portal" to check the status of enrollment.

So, what I did was: I downloaded and installed Microsoft's "Company Portal" on my own device along with one of the affected devices. My device is showing as enrolled; the affected device is showing as unenrolled. When I attempt to enroll the device, it stops me when I input the email - it says something along the lines of "Device is already enrolled" :P

There is something awry with this sync, so my next step is to try "DSREGCMD /leave" on the affected device, maybe blast away any remnants of the device in the backend, and rejoin via the "Company Portal" app.

(Also to note: You can use "Company Portal" to see devices you have enrolled, too. The person who originally registered this device with Intune said that it's not showing as registered to them, so clearly there is a broken link.)
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Crystal-MSFT 48,156 Reputation points Microsoft Vendor

2022-08-04T01:31:01.053+00:00

@Stanislaw Koltschin , From your description, it seems the Azure AD register device didn't get the compliance status in Azure AD while it is compliant in Intune. if there's any misunderstanding, please let us know.

Based on my checking in my environment, the Azure AD register device which is enrolled into Intune can see the compliant status in Azure AD as well. But it needs some time.

For your situation, please ensure the user has Azure AD premium license and Intune license assigned, restart the device and wait some more time to see if the compliance status will show in Azure AD.

however, if the issue still persists, I think the issue may occur on the background when sync the status from Intune to Azure AD. Here, we suggest to open case to check in the background to help on this issue:
https://learn.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-troubleshooting-support-howto

Thanks for your understanding and hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
JamesTran-MSFT 36,606 Reputation points Microsoft Employee

2022-08-08T23:05:04.717+00:00

@Stanislaw Koltschin
I just wanted to check in and see if you had any other questions or if you were able to resolve this issue?

If you have any other questions, please let me know.
Thank you for your time and patience throughout this issue.

----------

Please remember to "Accept Answer" if any answer/reply helped, so that others in the community facing similar issues can easily find the solution.

Stanislaw Koltschin 6 Reputation points

2022-08-12T13:08:48.267+00:00

Hello,

Well I am still on it with the Microsoft support.

One instance of this issue was resolved by

Disconnect the work account

Remove old enrollments from the Windows Registry (in that case there was a MAM registration left over. Also "MAM registration" in Azure AD was set to all user scope. If it is not needed it can be set to none or specific user groups)

Make sure that the device is deleted from Intune and Azure AD

Re-register the device

The same process did not work with another device.
There it is still not showing the MDM registration properly, although we did all previous steps, plus:

dsregcmd /leave, which basically wipes all Azure AD joins and registrations.

But that device is and must be Azure AD joined in another tenant,
maybe that somehow hinders the proper registration and compliance check of the second work account.

Crystal-MSFT 48,156 Reputation points Microsoft Vendor

2022-08-16T06:21:10.01+00:00

@Stanislaw Koltschin , Thanks for letting us know the latest status. From your description, I know one device is working after trying the solutions you provided. Thanks for your sharing. It can help others who has the same issue.

But another device seems in another tenant can't work. If there's any more update for this device in the support case,, I appreciate your help to share here.

Thanks for your time and have a nice day!

Caz 0 Reputation points

2023-08-17T05:25:16.9166667+00:00

Has anyone worked this out? I still see AzureAD as very unreliable in reporting Compliance status from Intune. Yes the users showing N/A in Azure Ad have Intune / Premium licenses etc.
It is not viable to re-register lots of devices in Azure Ad as this kicks off users from their Office 365 for up to a few hours. Any fix from Microsoft?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Rudy Ooms 611 Reputation points MVP

2023-08-17T08:36:53.8566667+00:00

Mmm.... at first you could think it is something todo about the mdm/mam scope

https://call4cloud.nl/2021/08/the-battle-between-aadj-and-aadr/

so lets start from there... could you verify the aadr devices are indeed intune enrolled ?
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Azure AD shows device compliance as "NA" while intune shows it as compliant

3 answers

Your answer