> For the complete documentation index, see [llms.txt](https://docs.intuneassistant.cloud/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.intuneassistant.cloud/intune-assistant/analyzer/compliance-coverage-analysis.md).

# Compliance Policy Coverage Analysis

## What It Does

If your tenant has the Intune setting **"Mark devices with no compliance policy assigned as Not compliant"** turned on, devices that fall outside every compliance policy's assignment become noncompliant under a built-in rule. Intune tells you *that* a device has no compliance policy — it doesn't tell you *why*.

The Compliance Policy Coverage Analysis answers that question. For every device Intune reports as missing a compliance policy, it works through each compliance policy in your tenant the same way you would by hand: does this policy's assignment reach the device or its user, does an exclusion apply, does an assignment filter let the device through? Every result is backed by evidence — a matched or unmatched group, a proven exclusion, a filter outcome — never a guess.

It covers Windows, iOS, Android, and macOS devices.

***

## How to Use It

### Run the full analysis

1. Navigate to **Analyzer → Compliance Coverage** in the left sidebar.
2. Click **Run Analysis**. This schedules the real "devices without a compliance policy" report at Intune, waits for it to finish, and then checks every device it lists.
3. The page shows live progress while it runs — this can take anywhere from a few seconds to a few minutes depending on how many devices and compliance policies your tenant has. You can click **Cancel** at any point to stop it — this immediately removes anything gathered so far.
4. When it finishes, you'll see a summary of how many devices were found, broken down by result, followed by the full device list.
5. Click any device row to expand it and see the reasoning for every compliance policy that was checked against it.

### Investigate a single device

1. Go to **Devices → Overview** and open a device that shows as **Noncompliant**.
2. In the device details panel, find the **Compliance Policy Investigation** card and click **Why no compliance policy?**
3. The result appears inline within a couple of seconds — no need to run the full tenant-wide analysis first.

***

## What You'll See

### Summary cards

* **Devices without a compliance policy** — how many devices Intune currently reports in this state.
* One card per result type (see below), with a count.

### Per-device result

Each device gets one overall result and a breakdown per compliance policy:

| Result                       | What it means                                                                                                                                                                                                                                     |
| ---------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Should Apply But Missing** | A policy's assignment genuinely reaches this device — no exclusion, no filter blocking it — yet Intune isn't applying it. This is the case worth escalating: check the device's check-in history, enrollment state, or recent assignment changes. |
| **Not Targeted**             | Neither the device nor its user is in scope for any compliance policy's assignment. This is usually the real explanation — the device (or its user) simply isn't covered by any assignment yet.                                                   |
| **Excluded**                 | An assignment would otherwise apply, but the device or user is a member of an exclusion group on that policy.                                                                                                                                     |
| **Filtered Out**             | An assignment would otherwise apply, but an assignment filter attached to it doesn't permit this device.                                                                                                                                          |
| **Unknown**                  | Something couldn't be fully verified — usually a group membership check that failed, or an assignment filter that uses syntax this analysis doesn't yet support. Never silently treated as "not applicable."                                      |

A device with no primary user gets an additional note: assignments made to a user group can never reach a device with nobody signed in. If the device is meant to be shared, it needs a device-based assignment (a device group, or "All Devices") instead.

***

## Requirements

* You need an active IntuneAssistant subscription — this analysis is included for every customer, it isn't a separate paid add-on.
* Neither the tenant-wide run nor the single-device investigation needs a Worker set up — both work immediately for any active customer.
* If you'd rather have this run automatically on a schedule and emailed to you, you can additionally set it up as a Worker job under **Worker → Jobs** — that path does require a registered Worker, same as any other scheduled job.

***

## Common Questions

**Why does the tenant-wide run take a while the first time?** It has to read every compliance policy and its assignments, every assignment filter, and check group membership for every device (and its user) found in the "no compliance policy" state. Policies, assignments, and filters are only fetched once per run, not once per device.

**A device shows "Unknown" for a policy — what should I do?** Usually this means one of the policy's assigned groups couldn't be checked, most often because it has hidden membership (which needs an extra permission we don't request by default). Re-run the single-device investigation from the Devices page for more detail.

**Does this fix anything automatically?** No — this is a read-only, evidence-gathering tool. It never changes an assignment, group, filter, or device.

**Does the tenant-wide run keep my device data afterward?** No. Results are shown to you while you're looking at the page and then discarded — nothing about which devices were found, or why, is kept in the backend. You can also cancel a run in progress at any time; doing so immediately stops it and removes anything gathered so far.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.intuneassistant.cloud/intune-assistant/analyzer/compliance-coverage-analysis.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.