Compliance Policy Coverage Analysis
What It Does
If your tenant has the Intune setting "Mark devices with no compliance policy assigned as Not compliant" turned on, devices that fall outside every compliance policy's assignment become noncompliant under a built-in rule. Intune tells you that a device has no compliance policy — it doesn't tell you why.
The Compliance Policy Coverage Analysis answers that question. For every device Intune reports as missing a compliance policy, it works through each compliance policy in your tenant the same way you would by hand: does this policy's assignment reach the device or its user, does an exclusion apply, does an assignment filter let the device through? Every result is backed by evidence — a matched or unmatched group, a proven exclusion, a filter outcome — never a guess.
It covers Windows, iOS, Android, and macOS devices.
How to Use It
Run the full analysis
Navigate to Analyzer → Compliance Coverage in the left sidebar.
Click Run Analysis. This schedules the real "devices without a compliance policy" report at Intune, waits for it to finish, and then checks every device it lists.
The page shows live progress while it runs — this can take anywhere from a few seconds to a few minutes depending on how many devices and compliance policies your tenant has. You can click Cancel at any point to stop it — this immediately removes anything gathered so far.
When it finishes, you'll see a summary of how many devices were found, broken down by result, followed by the full device list.
Click any device row to expand it and see the reasoning for every compliance policy that was checked against it.
Investigate a single device
Go to Devices → Overview and open a device that shows as Noncompliant.
In the device details panel, find the Compliance Policy Investigation card and click Why no compliance policy?
The result appears inline within a couple of seconds — no need to run the full tenant-wide analysis first.
What You'll See
Summary cards
Devices without a compliance policy — how many devices Intune currently reports in this state.
One card per result type (see below), with a count.
Per-device result
Each device gets one overall result and a breakdown per compliance policy:
Should Apply But Missing
A policy's assignment genuinely reaches this device — no exclusion, no filter blocking it — yet Intune isn't applying it. This is the case worth escalating: check the device's check-in history, enrollment state, or recent assignment changes.
Not Targeted
Neither the device nor its user is in scope for any compliance policy's assignment. This is usually the real explanation — the device (or its user) simply isn't covered by any assignment yet.
Excluded
An assignment would otherwise apply, but the device or user is a member of an exclusion group on that policy.
Filtered Out
An assignment would otherwise apply, but an assignment filter attached to it doesn't permit this device.
Unknown
Something couldn't be fully verified — usually a group membership check that failed, or an assignment filter that uses syntax this analysis doesn't yet support. Never silently treated as "not applicable."
A device with no primary user gets an additional note: assignments made to a user group can never reach a device with nobody signed in. If the device is meant to be shared, it needs a device-based assignment (a device group, or "All Devices") instead.
Requirements
You need an active IntuneAssistant subscription — this analysis is included for every customer, it isn't a separate paid add-on.
Neither the tenant-wide run nor the single-device investigation needs a Worker set up — both work immediately for any active customer.
If you'd rather have this run automatically on a schedule and emailed to you, you can additionally set it up as a Worker job under Worker → Jobs — that path does require a registered Worker, same as any other scheduled job.
Common Questions
Why does the tenant-wide run take a while the first time? It has to read every compliance policy and its assignments, every assignment filter, and check group membership for every device (and its user) found in the "no compliance policy" state. Policies, assignments, and filters are only fetched once per run, not once per device.
A device shows "Unknown" for a policy — what should I do? Usually this means one of the policy's assigned groups couldn't be checked, most often because it has hidden membership (which needs an extra permission we don't request by default). Re-run the single-device investigation from the Devices page for more detail.
Does this fix anything automatically? No — this is a read-only, evidence-gathering tool. It never changes an assignment, group, filter, or device.
Does the tenant-wide run keep my device data afterward? No. Results are shown to you while you're looking at the page and then discarded — nothing about which devices were found, or why, is kept in the backend. You can also cancel a run in progress at any time; doing so immediately stops it and removes anything gathered so far.
Last updated