Faster compliance updates for Windows in Intune

A user turns off the firewall on a laptop, or BitLocker is not yet on after a reinstall. Intune and Conditional Access work with the compliance status of the last check-in. Without a trigger, a device that has been enrolled for a while checks in about once every eight hours.

In the week of 14 September 2026, Intune changed something about that: Windows devices can request a new compliance evaluation themselves when a relevant setting changes. In this blog post you read how this client-driven compliance evaluation works, which settings it covers, and where in the Intune admin center you view the reported compliance status.

What is client-driven compliance evaluation?

A compliance policy is evaluated when the device checks in with Intune, although not every sync leads to a new calculation. According to Microsoft, the regular maintenance sync takes place about every eight hours, and a device gets at most one every 6.5 hours. In addition, there are syncs started by a change, for example when you assign a policy. Right after enrollment, a Windows device temporarily checks in more often.

With client-driven compliance evaluation, the device does not have to wait for the next maintenance sync when a compliance setting changes. Microsoft describes two mechanisms that can each request a check-in:

• Periodic check on the device. The Intune Management Extension (IME) compares the current values of the monitored settings with the previous ones at set times. If the IME sees a difference, the device checks in and a compliance evaluation follows.
• Real-time detection. For a number of important settings, Intune sees a change the moment it happens and then requests a check-in itself.

Real-time detection applies to these settings:

Microsoft only publishes the signals in the left column, not which policy settings belong to them. The right column is an interpretation: an aid to review your policy, not a guarantee that each listed setting is reassessed in real time on its own.

💡 Note: Microsoft is not consistent about the status. The documentation itself does not mention a preview, but the announcement in What’s new and the page about compliance reporting link to a heading with -preview in the address. Keep in mind that the behavior may still change.

What do you need?

• A Microsoft Intune subscription.
• Microsoft Entra ID P1 or P2 if you use compliance in Conditional Access.
• Windows devices that are enrolled in Intune. Microsoft speaks of “supported Windows devices”, but does not name a minimum Windows version in the documentation.
• A compliance policy for the Windows 10 and later platform.
• To create and assign compliance policies: a role with those permissions, such as the built-in Intune role Policy and Profile Manager. For viewing only, Read Only Operator is enough.

The documentation names no setting to turn the feature on and describes it as something supported devices do by themselves.

Check that your compliance policy uses the right settings

A faster evaluation changes the compliance status only if your policy actually checks the changed setting. If a setting is Not configured, Intune does not assess it as a condition for compliance.

1. Open the Microsoft Intune admin center.
2. Navigate to Devices > Compliance.
3. Select your compliance policy for Windows and open the Properties tab. There you see how each setting is configured.
4. Check which settings from the table are set to Require or have a value.
5. Adjust the settings from the same tab if needed and save the change.

💡 Note on Require BitLocker: that value is measured through Device Health Attestation only at startup. A device on which encryption has just finished becomes compliant only after a restart, even if the change itself is noticed quickly.

Make sure the Intune Management Extension is on the device

The periodic check runs through the Intune Management Extension. It is not always installed: Intune puts the IME on a device that meets the requirements as soon as you assign it, for example, a PowerShell script, a Win32 app, a remediation or a discovery script for custom compliance. Windows in S mode is not supported.

You check for the IME on the device itself: Task Manager then shows the IntuneManagementExtension service. The documentation does not say whether real-time detection also depends on the IME.

View the result in the reporting

Compliance reports in Intune are updated when a device checks in. Because a device with client-driven compliance evaluation checks in by itself more often after a change, the reports for such a device can also be updated sooner.

1. Navigate to Devices > Compliance and choose the Monitor tab.
2. Look at the Device compliance status tile. It shows the number of devices per status, such as compliant, in grace period, not evaluated and not compliant. If you select the tile, the report with non-compliant devices opens.
3. Open your compliance policy and select Per-setting status to see per setting how many devices meet it.

These reports show the status of the last check-in. They don’t show which mechanism started an evaluation, or how much faster it was. Overviews and detail lists are also not always updated at the same time, so the numbers can differ temporarily.

Intune has built-in throttling for these extra evaluations. If many changes follow each other quickly, part of them may only be processed in a later round. So fast is not the same as immediate.

User experience

For the user, little visible changes. The difference is mainly in access: if a device becomes non-compliant, a Conditional Access policy that requires a compliant device can block access sooner. Once the issue is fixed, access can also come back sooner. What such a policy looks like, you read in Stronger security with Conditional Access: require MDM and compliance.

An existing session does not stop the moment Intune has the new status. Conditional Access reassesses access when an app gets a new access token. Without continuous access evaluation (CAE), such a token is valid for one hour by default; in a CAE session that can go up to 28 hours. Compliance is not among the events that CAE enforces in between, and Microsoft does not document how quickly a compliance change ends a running CAE session.

Users who don’t want to wait can have the status checked themselves in the Company Portal app through Devices > Check Status, or sync through Settings > Sync.

📚 Read more: How compliance calculation is triggered on Windows devices.

Wrapping up

Client-driven compliance evaluation can shorten the time between a change on a supported Windows device and the updated compliance status in Intune. That applies only to the settings your policy actually checks, and throttling or the restart that Require BitLocker needs can delay it. So review your Windows policy for the settings in the table.