CIS.M365.4.1: Ensure devices without a compliance policy are marked 'not compliant'

CIS Benchmark notice

This check implements a recommendation of the CIS Microsoft 365 Foundations Benchmark. The benchmark text is © Center for Internet Security, Inc. and is not reproduced here beyond the short summary below. Get the full benchmark free of charge from cisecurity.org.

ID	CIS.M365.4.1
Severity	Medium
Suite	CIS Microsoft 365 Foundations Benchmark
Product	Intune
Feature	Device compliance
Security area	Devices and endpoints
Resource type	Tenant
User impact of fixing	Medium
Effort to fix	Medium
Benchmark	CIS Microsoft 365 Foundations Benchmark 7.0.0, 4.1 (L1, E3 Level 1, E5 Level 1)
Framework controls	cis-m365:4.1 nist-800-53-r5:AC-19 Access Control for Mobile Devices nist-800-53-r5:CM-6 Configuration Settings
MITRE ATT&CK	T1078.004
Reads from	Microsoft Graph
Licence needed	INTUNE_A

What this checks and how to fix it

4.1 (L1) Ensure devices without a compliance policy are marked ‘not compliant’

Compliance policies are sets of rules and conditions that are used to evaluate the configuration of managed devices. These policies can help secure organizational data and resources from devices that don’t meet those configuration requirements. Managed devices must satisfy the conditions you set in your policies to be considered compliant by Intune. When combined with Conditional Access, this allows more control over how non-compliant devices are treated.

The recommended state is Mark devices with no compliance policy assigned as Not compliant

Rationale

Implementing this setting is a first step in adopting compliance policies for devices. When used in together with Conditional Access policies the attack surface can be reduced by forcing an action to be taken for non-compliant devices.

Note: This section does not focus on which compliance policies to use, only that an organization should adopt and enforce them to their needs.

Impact

Any devices without a compliance policy will be marked not compliant. Care should be taken to first deploy any new compliance policies with a Conditional Access (CA) policy that is in the Report-only state. After the environment’s device compliance is better understood it is then appropriate to finally align with Mark devices with no compliance policy assigned as and enable any CA policies that enforce actions based on device compliance.

If a mature environment already has an existing device compliance CA policy and a large number of devices without an assigned compliance policy, this could cause disruption as those devices would then be suddenly considered not compliant.

Remediation action

1. Navigate to Microsoft Intune admin center.
2. Click on Devices and then under Managed devices on Compliance.
3. Click Compliance settings.
4. Ensure Mark devices with no compliance policy assigned as set to Not compliant

PowerShell

1. Connect to Microsoft Graph using Connect-MgGraph -Scopes "DeviceManagementConfiguration.ReadWrite.All"
2. Run the following commands:

$Uri = 'https://graph.microsoft.com/v1.0/deviceManagement'
$Body = @{
    settings = @{
        secureByDefault = $true
    }
} | ConvertTo-Json
Invoke-MgGraphRequest -Uri $Uri -Method PATCH -Body $Body

Related links

• Microsoft Intune admin center
• Use compliance policies to set rules for devices you manage with Intune
• CIS Microsoft 365 Foundations Benchmark v7.0.0 - Page 184

---

Mito check, based on CIS Microsoft 365 Foundations Benchmark. Author: oed-metzb; contributors: Mynster9361, Korthal-Maiyn. Open-source licences.