MT.1054: Ensure built-in Device Compliance Policy marks devices with no compliance policy assigned as 'Not compliant'
| ID | MT.1054 |
| Severity | Medium |
| Suite | Mito |
| Product | Intune |
| Feature | Device compliance |
| Security area | Devices and endpoints |
| Resource type | Tenant |
| User impact of fixing | Medium |
| Effort to fix | Medium |
| Framework controls | nist-800-53-r5:AC-19 Access Control for Mobile Devicesnist-800-53-r5:CM-6 Configuration Settings |
| MITRE ATT&CK | T1078.004 |
| Reads from | Microsoft Graph |
| Licence needed | INTUNE_A |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Ensure the built-in Device Compliance Policy marks devices with no compliance policy assigned as ‘Not compliant’.
Set your Intune built-in Device Compliance Policy to mark devices with no compliance policy assigned as ‘Not compliant’. This ensures that new devices that do not have any policies assigned are not compliant per default.
Remediation action:
Section titled “Remediation action:”To change the built-in device compliance policy:
- Navigate to Microsoft Intune admin center.
- Click Devices scroll down to Manage devices.
- Select Compliance and Select Compliance settings.
- Set Mark devices with no compliance policy assigned as to Not compliant
- Click Save.
Related links
Section titled “Related links”Mito check. Author: HenrikPiecha; contributors: merill. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.