Intune: Compliance settings

The tenant-wide switches under Devices > Compliance > Compliance settings. Not a policy per device, but the service-level defaults every managed device evaluates as a built-in compliance policy: how an unmanaged-by-policy device is treated, and how long a compliance verdict stays valid.

📚💻CS - Compliance Settings

Mark devices with no compliance policy as Not compliant, and set the compliance status validity period so a stale device stops counting as trusted. Roll it out behind a report-only Conditional Access policy so you tighten the net without locking anyone out.