Microsoft Intune Device Compliance Integration

The Microsoft Intune Device Compliance integration allows SimpleMDM to act as a registered compliance partner for Microsoft Intune. SimpleMDM evaluates your managed Apple devices against criteria you define, then reports each device's compliance state to Intune, which records it in Microsoft Entra ID. Microsoft Entra Conditional Access policies can then use that state to allow or block access to Microsoft 365 and other organizational resources.

Organizations that use Microsoft as their identity provider typically already enforce Conditional Access on Windows devices through Intune. Without a compliance partner, Apple devices managed outside of Intune have no compliance state in Entra ID, so they either fall outside Conditional Access entirely or are blocked. This integration closes that gap: a Mac that has FileVault disabled or an iPhone with no passcode can be blocked from signing in to Outlook, Teams, or Exchange until it is brought back into compliance.

Microsoft documentation for this capability:

• Support third-party device compliance partners in Intune
• Device compliance policies in Microsoft Intune - Integrate with Conditional Access
• What is Conditional Access?

How the integration works

There are three concepts to understand before you begin. Each is configured separately, and each does a different job.

• Scope: which devices SimpleMDM evaluates and reports on. Configured separately for iOS and macOS. Devices outside of scope are reported to Microsoft as unmanaged and receive no compliance state from SimpleMDM.
• Compliance group: a SimpleMDM Dynamic Group whose membership is your compliance policy. A device that is in scope and a member of the compliance group is reported as compliant. A device that is in scope but not a member is reported as not compliant. You define the actual criteria — FileVault, passcode, OS version, and so on — using the Dynamic Group's device filter.
• Registration: the device user signs in with their Microsoft account through the SimpleMDM app, which links the physical device to their Entra ID identity. Until a device is registered, Microsoft has no way to associate the compliance signal with the user attempting to sign in.

SimpleMDM re-evaluates every in-scope device against its compliance group every 30 minutes, and uploads compliance state to Microsoft every hour. Registering a device, or an end user requesting a refresh, triggers an immediate evaluation and upload for that device. These intervals are fixed and not configurable.

Supported platforms

This integration supports macOS and iOS/iPadOS devices managed by SimpleMDM.

Requirements

Microsoft requirements

The following must be in place in your Microsoft tenant before you begin. Detailed setup for each is covered in Microsoft's documentation — the summary below is intended to help you confirm you have everything ready.

• Microsoft Intune subscription with access to the Microsoft Intune admin center. Intune is included in Microsoft 365 E3/E5, Enterprise Mobility + Security E3/E5, and Business Premium, among others, or can be licensed standalone.
• Intune licenses assigned to your device users. Every user whose devices will be evaluated needs an Intune license, even though their devices are managed by SimpleMDM rather than Intune.
• Microsoft Entra ID P1 or higher for the users covered by Conditional Access. Conditional Access is an Entra ID premium capability and is not included in the free tier.
• Administrative roles. Connecting the integration requires an account that can grant tenant-wide admin consent to a Microsoft Entra application — typically Global Administrator. Registering SimpleMDM as a compliance partner requires Intune Administrator or Global Administrator. Creating or modifying the Conditional Access policy requires Conditional Access Administrator, Security Administrator, or Global Administrator. In many organizations these are different people, so plan accordingly.
• A Microsoft Entra security group containing the users whose devices SimpleMDM will manage. Compliance partner assignment and Conditional Access are both targeted at user groups, not device groups. A standard security group with the "Assigned" membership type is sufficient.
• A Conditional Access policy targeting that group, with the access control set to require the device to be marked as compliant.
• The SimpleMDM registration apps must be excluded from that Conditional Access policy. The SimpleMDM iOS and macOS apps are what device users sign in through to register, and they appear in Microsoft Entra ID as enterprise applications. If the policy blocks them, users can never complete registration. See the note below.
• Only one compliance partner per platform per tenant. If another MDM is already registered as your iOS or macOS compliance partner, it must be removed before SimpleMDM can be registered for that platform.

Important Note: Your Conditional Access policy must not block the sign-in the device user performs during registration. Registration is a chicken-and-egg problem: the user has to authenticate with Microsoft through the SimpleMDM app before the device has any compliance state, so a policy that blocks all resources for non-compliant devices blocks the very sign-in the user needs to become compliant. The user gets stuck — they cannot register, so they never become compliant, so they stay blocked.

To avoid this, do one of the following in your Conditional Access policy:

• Under Target resources, add the SimpleMDM applications to the Exclude list, or
• Under Target resources, select only the specific resources you want to protect (for example Office 365, Exchange Online) rather than All resources.

Always test registration end-to-end with a pilot device before applying the policy to production users.

SimpleMDM requirements

• The integration must be enabled on your SimpleMDM account. If you do not see Integrations in the left-hand navigation, contact SimpleMDM support.
• Your user role must have the General permission enabled to configure the integration. This is the same permission that controls account settings.
• For iOS/iPadOS: a connected Content Token (VPP) with licenses for Microsoft Authenticator and the SimpleMDM app. Both are required to register a device. Add at least one license of each for every device you intend to enable Conditional Access on.
• For macOS, Munki must be enabled on the account for SimpleMDM to deploy Microsoft Intune Company Portal automatically. If Munki is not enabled, you are responsible for deploying Company Portal to your Macs by another method — registration cannot complete without it.

Recommended setup order

The integration can be configured in any order, but the sequence below avoids the most common problem during rollout: accidentally marking production devices non-compliant and locking users out of Microsoft resources before you have verified your criteria.

1. Build and verify your compliance groups first, so your criteria are settled before anything is reported to Microsoft.
2. Create a small pilot scope group containing only test devices.
3. Configure Microsoft to treat devices with no reported compliance state as Compliant during the pilot. This is the Mark devices with no compliance policy assigned as setting, found in the Microsoft Intune admin center under Endpoint security > Device compliance > Compliance policy settings.
4. Connect the integration scoped only to the pilot group, and validate the full end-user experience.
5. Expand scope to production and decide how devices with no compliance state should be treated going forward.

Step 1: Create your compliance groups

Your compliance criteria are defined by a SimpleMDM Dynamic Group. Any device filter you can build into a Dynamic Group can be used as a compliance rule. You need one compliance group per platform you plan to evaluate.

To create a compliance group:

1. In SimpleMDM, go to Groups and click the create group button.
2. Select the Dynamic group type. Static groups cannot be used as compliance groups.
3. Give the group a clear name, for example "Intune Compliance - macOS" or "Intune Compliance - iOS".
4. Build the device filter using the criteria your organization requires.
5. Save the group and review its membership before continuing.

Example criteria for a macOS compliance group:

• Full Disk Encryption is true (this is the FileVault status)
• System Integrity Protection Enabled is true
• Firewall Enabled is true
• OS Version is greater than or equal to your required minimum

Example criteria for an iOS compliance group:

• Passcode Present is true
• Supervised is true
• OS Version is greater than or equal to your required minimum

Note: Review the group's membership carefully before connecting the integration. Every in-scope device that is not in this group will be reported to Microsoft as not compliant. A filter that is stricter than you intended will lock users out.

A group cannot be used as both a scope group and a compliance group for the same platform. Keep them separate.

Step 2: Create a pilot scope group

Scope determines which devices are evaluated at all. For your initial setup, create a group containing only devices you are willing to lock yourself out of.

1. Go to Groups and click the create group button.
2. Create a Static group named something like "Intune Pilot - macOS".
3. Add one or two test devices assigned to a test user account. Do not include production devices.
4. Repeat for iOS if you plan to evaluate both platforms.

Scope groups may be static or dynamic. Static groups are easier to control during a pilot.

Step 3: Prepare the Microsoft side

Complete the following in the Microsoft Entra and Intune admin centers. Microsoft's interface changes periodically; refer to Microsoft's own documentation for the current navigation if these paths do not match what you see.

Create a user group and Conditional Access policy

1. In the Microsoft Entra admin center, go to Groups and create a new Security group with the Assigned membership type. Add the users whose devices will be evaluated. For a pilot, add only your test user.
2. Go to Protection > Conditional Access > Policies and create or edit the policy that will require device compliance.
3. Under Users, include the security group you created.
4. Under Target resources, select the resources the policy should protect. Exclude the SimpleMDM applications, or select only specific resources rather than all resources, so that users are not blocked from the sign-in they need to complete registration. See the note under Microsoft requirements.
5. Under Grant, select Require device to be marked as compliant.
6. Save the policy.

Set how Microsoft treats devices with no compliance state

This is a tenant-wide Intune setting that determines what happens to any device that has not had a compliance state reported for it. During your pilot, set it to Compliant so that your production devices are unaffected while you test.

1. In the Microsoft Intune admin center, go to Endpoint security > Device compliance > Compliance policy settings.
2. Set Mark devices with no compliance policy assigned as to Compliant.
3. Save.

You will revisit this setting before going to production. See Moving to production below.

Register SimpleMDM as a compliance partner

This step is performed from within the SimpleMDM setup wizard, which links directly to the correct page in the Intune admin center. It is described in Step 4 below. For reference, the page is located at Tenant administration > Connectors and tokens > Partner compliance management.

Step 4: Connect the integration in SimpleMDM

In SimpleMDM, go to Integrations, find the Microsoft Intune Device Compliance card, and click "Set Up". This opens the Microsoft Intune Device Compliance Set Up wizard.

The wizard has six steps. Your progress is saved as you go, so you can close the wizard and resume later. Use "Back" and the step indicators at the top to move between completed steps.

Step 1 of 6: Connect Microsoft Tenant

1. Click "Sign In & Grant Permissions". A Microsoft sign-in window opens.
2. Sign in with an account that can grant tenant-wide admin consent, and review and accept the permissions SimpleMDM requests.
3. When consent is granted, the wizard displays "Access Granted!".
4. Click "Next".

This step displays the note "You will need to sign in with an account that has Global Administrator or Intune Administrator permissions." In most tenants, granting tenant-wide admin consent to a new application requires Global Administrator. If your Intune Administrator account cannot complete this step, have a Global Administrator perform it.

Note: Consent is granted to the SimpleMDM application for your entire tenant, not for the individual admin account that signs in. SimpleMDM does not store credentials for the signing-in user.

Step 2 of 6: Create Compliance Partner

This step registers SimpleMDM as the compliance partner for each platform in your Intune tenant.

1. Click "Create a Compliance Partner". The Intune admin center opens in a new tab, on the Partner compliance management page.
2. In Intune, click Add compliance partner.
3. From the Compliance partner dropdown, select SimpleMDM (PDQ.com).
4. Select the Platform â€” iOS or macOS. Each partner entry covers a single platform, so a separate entry is required for each one you plan to support.
5. On Assignments, select the Entra ID user group you created in Step 3. Include or exclude additional groups as needed.
6. On Review + create, review your selections and click Create.
7. To support both iOS and macOS, repeat this process to create a second partner entry for the other platform.
8. Return to the SimpleMDM wizard and click "Verify Connection". On success you will see "Intune connection verified successfully."
9. Click "Next".

If verification fails, SimpleMDM displays "Failed to verify Intune connection. Please try again." Confirm the partner entry was created and saved in Intune, then click "Verify Connection" again. After a successful verification, the Last successful sync timestamp on the Intune partner compliance page updates.

Step 3 of 6: Select Microsoft Groups

Select the Microsoft Entra ID user groups whose members will be subject to compliance enforcement. Users in these groups need to register their devices in order to be evaluated and to have Conditional Access enforced.

1. In the "Search and add groups in Microsoft Entra ID for Conditional Access" field, search for and select the security group you created in Step 3.
2. Click "Next".

Note: The groups you select here apply to both iOS and macOS.

Step 4 of 6: Configure Scope

Choose which devices are evaluated for compliance. Scope is configured independently for iOS and macOS.

• None: Devices of this OS will not be evaluated for compliance. Use this for a platform you are not rolling out yet.
• All Devices: All devices of this OS type will be evaluated for compliance.
• Include Groups: Only devices that are members of these groups will be evaluated for compliance. Devices not in this group will not be evaluated.

For your initial setup, select Include Groups and choose only the pilot group you created in Step 2.

Step 5 of 6: Configure Compliance Groups

Select the Dynamic Group that defines compliance for each platform. Devices that are in scope and members of the selected group are considered compliant.

1. Under "iOS Compliance Group" and "macOS Compliance Group", select the compliance groups you created in Step 1.
2. Confirm the device count shown beneath each selected group looks correct.
3. Click "Next".

Only Dynamic Groups can be selected. A compliance group is required for any platform whose scope is set to All Devices or Include Groups, and it cannot be the same group used for that platform's scope.

Step 6 of 6: Review Configuration

The review step summarizes your configuration and exposes the remaining settings. If there are configuration problems, they are listed under "Configuration Errors. Please resolve these issues before proceeding." — resolve these before saving.

For each platform, the summary shows:

• Scope: "Not evaluated", "All devices", or "Include: <group names>"
• Compliance Group: the selected group, or "Not selected"
• Devices in Scope: how many devices will be evaluated
• Compliant Devices: how many of those currently meet your criteria

Check these counts before saving. They are the clearest indication of what will happen the moment you enable the integration — if "Devices in Scope" is larger than you expect, go back and correct your scope before continuing.

Review settings explained

• Grace Period After Enrollment: A window after a device enrolls during which it is reported as compliant even if it does not yet meet your criteria. This prevents newly enrolled devices from being blocked while they are still completing registration and receiving configuration. Set a value between 0 and 90, and choose Hours or Days. A grace period of 0 means devices are evaluated immediately with no allowance.
• Enrollment Message: Shown to a user whose device is not yet registered when they attempt to access a Microsoft resource. Markdown formatting is supported. If left blank, a default message instructs the user to open the SimpleMDM app and tap Register under Microsoft Registration. Customize this if you want to add internal support contact details or a link to your own help desk.
• Remediation Message: Shown to a user whose device is registered but not compliant. Markdown formatting is supported. If left blank, a default message tells the user their device is out of compliance and to contact their administrator. This message appears above the list of specific compliance criteria the device is failing, so it works best as a short instruction rather than a full explanation.
• Integration Status: The "Integration enabled" toggle activates the integration. When disabled, all settings are retained but no compliance data is sent to Microsoft Intune.

Click "Save" to apply the configuration. The Integrations card now shows the integration as Enabled, and the "Set Up" button becomes "Settings".

What SimpleMDM deploys automatically

When you save an enabled configuration, SimpleMDM creates and assigns the following to every group in scope. You do not need to create or assign these yourself, and they are updated automatically whenever you change your scope.

• An extensible single sign-on profile for each platform in scope, named "Intune iOS SSO Profile - Automatically Generated" and "Intune macOS SSO Profile - Automatically Generated". These are declarative configurations that route Microsoft authentication through the Microsoft SSO extension, so that compliance is enforced in Safari and native apps such as Mail — not only inside Microsoft's own apps. See Microsoft's documentation on the Microsoft Enterprise SSO plug-in for Apple devices.
• The SimpleMDM app, for each platform in scope. This is the app the end user opens to register their device.
• Microsoft Authenticator, if iOS is in scope. This acts as the authentication broker for iOS registration.
• Microsoft Intune Company Portal, if macOS is in scope and Munki is enabled on the account. This acts as the authentication broker for macOS registration.

The SimpleMDM app and Microsoft Authenticator are deployed as non-removable, so users cannot delete them from their devices. Because the App Store apps consume licenses, confirm you have enough available licenses on your Content Token for the number of devices in scope.

Resources used by the integration are protected while in use. You cannot delete a group, unassign the required apps, or delete the generated SSO profile. Attempting to do so returns an error:

• "Cannot delete this group because it is required for Intune"
• "Cannot delete this profile because it is assigned as the SSO profile for Intune"

To remove these, first change your scope so the group is no longer in use, or disable the integration.

Step 5: The end-user experience

Once the integration is enabled and the required apps and profile have reached the device, walk a test device through the full experience before expanding scope. This is also the experience you will want to document for your own users.

Registering a device

Registration links the physical device to the user's Microsoft identity. Until it happens, the device has no compliance state and the user is blocked by Conditional Access.

On iOS/iPadOS:

1. The user attempts to access a Microsoft resource — for example, adding their Exchange account in the Mail app, or opening Outlook.
2. Microsoft blocks the sign-in and directs the user to a SimpleMDM-hosted page displaying your Enrollment Message.
3. The user opens the SimpleMDM app and taps Register under the Microsoft Registration section.
4. Microsoft Authenticator opens. The user selects or signs in with their work account.
5. Registration completes and the app confirms success.

On macOS:

1. The user attempts to access a Microsoft resource — for example, opening Outlook.
2. Microsoft blocks the sign-in and directs the user to a SimpleMDM-hosted page displaying your Enrollment Message.
3. The user opens the SimpleMDM app and clicks Register under the Microsoft Registration section.
4. Company Portal handles the authentication. The user selects or signs in with their work account.
5. Registration completes and the app confirms success.

Note: The Register button is disabled if the required broker app is missing — Microsoft Authenticator on iOS, Company Portal on macOS — and the app tells the user which app is needed. If users report a disabled Register button, confirm the app installed successfully and that licenses were available.

Registration triggers an immediate compliance evaluation and upload, so the device's state appears in SimpleMDM and Microsoft within a minute or two.

What a non-compliant user sees

When a registered device does not meet your compliance criteria, Microsoft blocks access and presents a message indicating the device must be compliant with the organization's requirements. Following the link takes the user to a SimpleMDM-hosted remediation page.

The user must sign in with their Microsoft account to view this page. After signing in, the page shows:

• Your Remediation Message at the top.
• Each of the user's registered devices, grouped by platform, with its current compliance status, device name, model, serial number, and when it was last evaluated.
• The specific compliance criteria the device is being evaluated against, so the user can see what is failing — for example, "Passcode Present = True".
• A Refresh action per device.

If the same Microsoft user is signed in on several devices, all of their registered devices appear on this page. Users cannot see other users' devices.

After correcting the issue — setting a passcode, enabling FileVault, installing an update — the user clicks Refresh. SimpleMDM requests a fresh inventory check-in from the device and re-evaluates compliance, then reports the result to Microsoft. The page displays "A device refresh has been requested. It may take a few minutes for the compliance status to update."

Refresh is rate limited to once per 60 seconds per device. If a user clicks again too soon they see a message asking them to wait.

Note: Because your compliance criteria come directly from the Dynamic Group's device filter, the criteria shown on this page are the raw filter conditions. Some conditions — such as membership in a scope group — are meaningful to you but not actionable by an end user. Keep this in mind when building compliance group filters, and use the Remediation Message to point users toward your help desk for anything they cannot resolve themselves.

Regaining access

Once a device is reported compliant, the user can retry the action that was blocked and access is granted.

Access is not revoked instantly when a device becomes non-compliant. Microsoft issues session tokens to applications, and those tokens remain valid for a period after the compliance state changes. In practice, users are typically blocked within an hour or two of a device going out of compliance, and iOS tends to reflect the change sooner than macOS. This is Microsoft's behavior and is not configurable from SimpleMDM.

Step 6: Verify the integration

Check all three systems to confirm data is flowing end to end.

In SimpleMDM:

• On the Devices list, add the MS In Scope?, MS Compliance Status, and MS Last Evaluated columns. Compliance status displays as Compliant, Not compliant, or Not evaluated.
• On a device's detail page, the MS Intune Device Compliance section shows In Scope, Compliance Status, Compliance Override, and Last Evaluated.

In Microsoft Intune: go to Tenant administration > Connectors and tokens > Partner compliance management and confirm the Last successful sync timestamp for each platform is recent.

In Microsoft Entra: go to Users, select your test user, and open Devices. Your registered devices appear with their compliance state.

Note: In the Entra device list, devices reported through a compliance partner show Microsoft Intune in the MDM column rather than SimpleMDM. This is expected — Intune is the system reporting the state to Entra ID on SimpleMDM's behalf.

Moving to production

Once your pilot devices register successfully, report the compliance states you expect, and are correctly blocked and unblocked by Conditional Access, expand the rollout.

1. In Microsoft Entra, add your production users to the security group targeted by the Conditional Access policy. Consider expanding in waves rather than all at once.
2. In SimpleMDM, go to Integrations, click "Settings" on the Intune card, and open the Configure Scope step.
3. Change scope to All Devices, or add your production groups under Include Groups.
4. On the Review Configuration step, check the Devices in Scope and Compliant Devices counts. The difference between these two numbers is how many users will be blocked once Conditional Access applies to them. If that number is high, address the underlying compliance issues before proceeding.
5. Consider setting a Grace Period After Enrollment of a few hours or days so newly enrolled devices are not blocked before they have registered and received their configuration.
6. Click "Save".

Deciding how devices with no compliance state are treated

Return to Endpoint security > Device compliance > Compliance policy settings in the Intune admin center and decide how Mark devices with no compliance policy assigned as should be set for production. This is a tenant-wide setting that affects every device in your tenant, not only those managed by SimpleMDM.

A device has no reported compliance state if it has not yet been registered, if it is outside the scope you configured, or if it is a platform this integration does not cover. There is no universally correct answer here — it is a decision about your organization's risk tolerance.

• Compliant: Devices with no reported compliance state are allowed access.
  • Impact: A smoother rollout. Users are only blocked once SimpleMDM has affirmatively reported their device as not compliant. New enrollments, out-of-scope devices, and devices from other platforms continue working.
  • Risk: A device that never registers is never blocked. Someone can avoid enforcement entirely by not completing registration, which undermines the purpose of the integration. A gap in reporting also silently grants access rather than denying it.
• Not compliant: Devices with no reported compliance state are blocked.
  • Impact: The stronger security posture, and Microsoft's recommendation when using Conditional Access. Access requires an affirmative compliant signal, so unregistered and unmanaged devices cannot reach protected resources.
  • Risk: Anything without a compliance state is locked out — including devices that have not finished registering, devices you intentionally left out of scope, and Windows or Android devices that do not have their own Intune compliance policy assigned. Users may be blocked before they have a chance to register, so make sure your Conditional Access policy still allows the registration flow, and communicate the change to users in advance.

A common approach is to remain on Compliant until registration coverage across your fleet is high, then switch to Not compliant to close the gap.

Managing compliance day to day

Manually re-checking a device

On a device's detail page, click the refresh icon next to Last Evaluated in the MS Intune Device Compliance section. You are asked to confirm: "This will re-evaluate the device against the compliance group. Are you sure?"

Overriding a device's compliance status

You can manually override the compliance status reported for an individual device — for example, to restore access for an executive travelling while a fix is pending.

1. On the device's detail page, click the edit icon next to Compliance Override.
2. In the Compliance Override dialog, set Override Status to one of:
   • None: No override. The device's status is determined by compliance group membership.
   • Compliant: Report the device as compliant regardless of whether it meets your criteria.
   • Not Compliant: Report the device as not compliant regardless of whether it meets your criteria.
3. Under Override Expiration, either check No expiration or select a date and time at which the override is automatically removed.
4. Click "Save".

An active override displays alongside its expiration, for example "Compliant (until March 4, 2027)" or "Compliant (indefinitely)". Expired overrides are cleared automatically and the device returns to normal evaluation. Overrides are recorded in the audit log.

Note: Use expiring overrides wherever possible. An indefinite "Compliant" override permanently exempts a device from your compliance criteria with no reminder that it exists.

Groups used by the integration

Groups used for Intune scope or compliance are marked with an Intune chip on the Groups list, with the tooltip "Used for Microsoft Intune evaluation". When editing one of these groups, a warning is displayed:

• For a compliance group: "This group is used for Microsoft Intune compliance evaluation. Changes to filters may affect device compliance status."
• For a scope group: "This group is used for Microsoft Intune scope evaluation. Changes to filters or device membership will affect which devices are included in scope."

Treat edits to these groups as production changes. Tightening a compliance group's filter can block users at the next evaluation, within 30 minutes.

Audit logs

The following events are recorded in your account's audit log:

• intune_registered: a device completed Microsoft registration.
• intune_device_id_changed: a device's Entra device identifier changed, typically after a wipe and re-registration.
• intune_manual_override: an admin set a manual compliance override.
• intune_override_expired: one or more overrides expired and were cleared automatically.
• intune_sync_failed: an upload of compliance data to Microsoft failed, including the error and the number of affected devices.

Disabling the integration

To pause the integration, go to Integrations, click "Settings" on the Intune card, navigate to the Review Configuration step, and turn off the Integration enabled toggle. All settings are retained, and compliance data stops being sent to Microsoft.

Important Note: Once compliance data stops flowing, how your users are affected depends entirely on your Mark devices with no compliance policy assigned as setting in Intune. If that setting is Not compliant, disabling the integration will block your users from Microsoft resources. Verify that setting before disabling.

Notes

• Compliance is re-evaluated every 30 minutes and uploaded to Microsoft every hour. Registration and manual refreshes trigger an immediate evaluation and upload for that device. These intervals are not configurable.
• Only two states are reported to Microsoft: compliant and not compliant. Devices that fall out of scope are reported as unmanaged and stop consuming an Intune compliance record — they are not reported as not compliant.
• Unenrolling or deleting a device in SimpleMDM sends a deactivation to Microsoft, marking the device unmanaged rather than reporting a compliance state for it. In Entra ID the device's MDM and security systems values are cleared and it is no longer reported as compliant, so it does not linger as a stale entry. How Conditional Access then treats that device depends on your Mark devices with no compliance policy assigned as setting.
• If a device is wiped and re-enrolled, its Entra device identifier changes. SimpleMDM deactivates the previous identifier automatically, but the user must complete registration again on the device.
• Only one compliance partner can be active per platform per tenant. Registering a new partner for a platform replaces the existing one.
• If Microsoft reports that the tenant has been deprovisioned on their side, SimpleMDM automatically disables the connection. Reconnect through the setup wizard.
• Deploying Company Portal to macOS may trigger Microsoft's own update prompts on the device shortly after installation. This is Company Portal's behavior, not SimpleMDM's.
• Compliance status is available as a device filter condition, so you can build Dynamic Groups or filter the device list by Intune compliance status.