Every IT lead who has turned on “require a compliant device” has a story about the CEO’s laptop. One missed update, one disabled firewall after a hotel Wi-Fi prompt, and suddenly the most important person in the business cannot open Outlook before a board meeting. The Intune compliance grace period exists to prevent exactly that. This article explains how grace periods work, how to set them so security still holds, and how to stop executives becoming a permanent exception.
How compliance and Conditional Access interact
Intune compliance policies define what a healthy device looks like: a supported OS version, BitLocker on, Defender running, a password set. When a device checks in, Intune evaluates it and marks it compliant or noncompliant. Microsoft Entra Conditional Access then reads that status and decides whether to allow access to email, Teams, SharePoint and other apps.
By default, every compliance policy includes one action: Mark device noncompliant, scheduled at 0 days. Microsoft’s documentation is explicit that this means immediately. The moment a device fails a check, it is noncompliant, and if Conditional Access requires compliance, access stops.
That is the right behaviour for some failures and the wrong one for others. A device with a confirmed malware infection should be cut off now. A device that is two days behind on a Windows update usually should not.
What a grace period actually does
Changing the schedule on Mark device noncompliant creates the grace period. If you set it to 3 days, a device that fails the policy stays in a grace state for 3 days. During that window the user can fix the problem and keep working. If it is still failing when the period ends, the device becomes noncompliant and Conditional Access applies.
Some useful details from Microsoft’s documentation:
The schedule accepts 0 to 365 days.
The admin center accepts decimals in 0.25 increments, so 0.25 is 6 hours and 0.5 is 12 hours. Other fractions need Microsoft Graph.
You can add other actions on their own schedules: send an email to the user, send a push notification, remotely lock the device (on supported mobile and Mac platforms) or add the device to the retire list.
Actions can repeat. Add the same email action at day 1 and day 3 to remind users twice.
Split policies by risk, not by platform alone
The most useful technique is not a single grace period. It is splitting your compliance settings into more than one policy, each with its own schedule. A device has to pass every compliance policy assigned to it, so you can be strict where it matters and forgiving where it does not.
Policy
Example settings
Mark noncompliant after
Critical security
Require BitLocker, require Defender antimalware, machine risk score from Defender for Endpoint at or below your threshold
0 days (immediately)
Hygiene
Firewall on, real-time protection on, password required
1 day
Currency
Minimum OS version, minimum Defender antimalware version
7 days, with emails at day 1 and day 5
With this layout, an infected or unencrypted laptop is blocked straight away. A user who skipped last week’s update gets a week and two reminders to restart before anything happens. In the tenants I review, the most common setup is a single policy containing everything at 0 days, which is why compliance gets a reputation for locking people out.
Configure it: step by step
In the Microsoft Intune admin center, go to Devices > Compliance and open the policy you want to change, then select Properties.
Next to Actions for noncompliance, select Edit.
On Mark device noncompliant, change the Schedule (days after noncompliance) to your grace period.
Add Send email to end user with a notification message template that explains what is wrong and how to fix it. Create the template first under compliance notifications.
Add a second email action at a later day as a final warning.
Save, then review the compliance reports over the next week to see how many devices enter and leave the grace state.
Write the notification email for a non-technical reader. “Your laptop needs a restart to finish installing a security update. Please restart before Thursday or you may lose access to email” works far better than a list of setting names.
Two tenant-wide settings to check
Under the compliance policy settings for the tenant, there are two values that affect lockouts as much as grace periods do:
Mark devices with no compliance policy assigned as: set this to Not compliant. Otherwise a device that falls out of every assignment group quietly passes Conditional Access.
Compliance status validity period (days): how long a device can go without reporting before it is treated as noncompliant. A laptop that sat in a drawer for six weeks should have to check in before it gets access again.
New devices and the first check-in
Brand-new devices are another common source of surprise lockouts. A laptop fresh out of Windows Autopilot may not report every compliance setting correctly until it has restarted and finished applying policy. Encryption, for example, may still be in progress during the first hour. If your critical policy marks devices noncompliant at 0 days, the new starter’s first sign-in can fail. Use the Enrollment Status Page to hold the user at setup until security policies and apps are installed, and test a full Autopilot build against your compliance policies before you change any schedules. A short, deliberate grace window on the hygiene policy is better than a new hire’s first day starting with a helpdesk call.
The CEO problem, handled properly
The tempting fix is to exclude the executive team from the Conditional Access policy. Do not. Executives are the most targeted people in any business, and an exclusion added during a crisis rarely gets removed.
Better options:
A VIP compliance policy assigned to a small executive device group with a longer grace period on currency settings, for example 10 days instead of 7. Critical security settings stay at 0 days for everyone.
Proactive support. Use the noncompliant devices report filtered to the VIP group and contact the executive’s assistant before the grace period ends.
Windows Autopatch or tuned update rings with deadlines and automatic restarts outside working hours, so updates rarely become a compliance issue in the first place.
Break-glass accounts, not people. Keep two emergency access accounts excluded from Conditional Access for tenant recovery. They are for when Conditional Access itself is broken, not for a user who has not restarted.
Frequently asked questions
What is the default Intune compliance grace period?
There is none by default. Every compliance policy includes the Mark device noncompliant action at 0 days, so devices are marked noncompliant immediately. You create a grace period by changing that schedule.
Can I set a grace period in hours?
Yes. The admin center accepts decimal values in 0.25 increments, so 0.25 equals 6 hours and 0.5 equals 12 hours. Other values, such as 8 hours, need to be configured through Microsoft Graph.
Should every compliance setting have the same grace period?
No. Put high-risk settings such as encryption and Defender threat level in a policy that marks devices noncompliant immediately, and put update and OS version settings in a separate policy with a few days’ grace and email reminders.
Want strict security without locking out your leadership team? Book a free Microsoft 365 security assessment and we will review your compliance and Conditional Access design.
Every IT lead who has turned on “require a compliant device” has a story about the CEO’s laptop. One missed update, one disabled firewall after a hotel Wi-Fi prompt, and suddenly the most important person in the business cannot open Outlook before a board meeting. The Intune compliance grace period exists to prevent exactly that. This article explains how grace periods work, how to set them so security still holds, and how to stop executives becoming a permanent exception.
How compliance and Conditional Access interact
Intune compliance policies define what a healthy device looks like: a supported OS version, BitLocker on, Defender running, a password set. When a device checks in, Intune evaluates it and marks it compliant or noncompliant. Microsoft Entra Conditional Access then reads that status and decides whether to allow access to email, Teams, SharePoint and other apps.
By default, every compliance policy includes one action: Mark device noncompliant, scheduled at 0 days. Microsoft’s documentation is explicit that this means immediately. The moment a device fails a check, it is noncompliant, and if Conditional Access requires compliance, access stops.
That is the right behaviour for some failures and the wrong one for others. A device with a confirmed malware infection should be cut off now. A device that is two days behind on a Windows update usually should not.
What a grace period actually does
Changing the schedule on Mark device noncompliant creates the grace period. If you set it to 3 days, a device that fails the policy stays in a grace state for 3 days. During that window the user can fix the problem and keep working. If it is still failing when the period ends, the device becomes noncompliant and Conditional Access applies.
Some useful details from Microsoft’s documentation:
Split policies by risk, not by platform alone
The most useful technique is not a single grace period. It is splitting your compliance settings into more than one policy, each with its own schedule. A device has to pass every compliance policy assigned to it, so you can be strict where it matters and forgiving where it does not.
With this layout, an infected or unencrypted laptop is blocked straight away. A user who skipped last week’s update gets a week and two reminders to restart before anything happens. In the tenants I review, the most common setup is a single policy containing everything at 0 days, which is why compliance gets a reputation for locking people out.
Configure it: step by step
Devices > Complianceand open the policy you want to change, then select Properties.Write the notification email for a non-technical reader. “Your laptop needs a restart to finish installing a security update. Please restart before Thursday or you may lose access to email” works far better than a list of setting names.
Two tenant-wide settings to check
Under the compliance policy settings for the tenant, there are two values that affect lockouts as much as grace periods do:
New devices and the first check-in
Brand-new devices are another common source of surprise lockouts. A laptop fresh out of Windows Autopilot may not report every compliance setting correctly until it has restarted and finished applying policy. Encryption, for example, may still be in progress during the first hour. If your critical policy marks devices noncompliant at 0 days, the new starter’s first sign-in can fail. Use the Enrollment Status Page to hold the user at setup until security policies and apps are installed, and test a full Autopilot build against your compliance policies before you change any schedules. A short, deliberate grace window on the hygiene policy is better than a new hire’s first day starting with a helpdesk call.
The CEO problem, handled properly
The tempting fix is to exclude the executive team from the Conditional Access policy. Do not. Executives are the most targeted people in any business, and an exclusion added during a crisis rarely gets removed.
Better options:
Frequently asked questions
What is the default Intune compliance grace period?
There is none by default. Every compliance policy includes the Mark device noncompliant action at 0 days, so devices are marked noncompliant immediately. You create a grace period by changing that schedule.
Can I set a grace period in hours?
Yes. The admin center accepts decimal values in 0.25 increments, so 0.25 equals 6 hours and 0.5 equals 12 hours. Other values, such as 8 hours, need to be configured through Microsoft Graph.
Should every compliance setting have the same grace period?
No. Put high-risk settings such as encryption and Defender threat level in a policy that marks devices noncompliant immediately, and put update and OS version settings in a separate policy with a few days’ grace and email reminders.
Microsoft’s guide to actions for noncompliant devices lists every action and the platforms that support it. If your compliance policies are causing more tickets than they prevent, an Intune health check will untangle them, and our Intune managed service watches compliance so problems are fixed before access is lost. Our endpoint security baseline includes a tested compliance policy layout.
Want strict security without locking out your leadership team? Book a free Microsoft 365 security assessment and we will review your compliance and Conditional Access design.