2 posts tagged with "EndpointSecurity"

You did everything right. Conditional Access requires a compliant device before anyone touches company data. You tested it, it worked, you closed the ticket, you felt good about yourself. ☕

Then one Tuesday you spot a device in the sign-in logs you have never seen before. Personal laptop. No management. No Intune. Nothing. And right next to it, in cheerful little green letters: Compliant.

Wait. What.

It started with a ticket:

"Hi IT, I wiped my device because Teams stopped syncing. Can you fix it?"

Weird.
So you check — and sure enough, the device is gone from Intune. Just... gone.
No wipe, no retirement event, nothing in logs. It just vanished like a magician's assistant. 🎩✨

Turns out, the user simply went to:
Settings → Accounts → Access work or school → Disconnect

That's it. Two clicks. No password prompt. No MFA.
And poof — device is unmanaged.