Compliance Policies & Proactive Remediation

📋 Compliance Overview & Lifecycle

🪟 Windows Compliance Settings

📱 iOS & Android Compliance

🍎 macOS Compliance

🛠️ Custom Compliance (JSON + PowerShell)

# Detection Script (PowerShell – runs on device)
# Returns JSON with key-value pairs for Intune to evaluate

$result = @{}

# Check if specific software version is installed
$app = Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
    Where-Object { $_.DisplayName -like "*CorporateSecurity*" }
$result["CorporateSecurityInstalled"] = [bool]$app
$result["CorporateSecurityVersion"] = if ($app) { $app.DisplayVersion } else { "0.0.0" }

# Check custom registry setting
$regVal = Get-ItemPropertyValue "HKLM:\SOFTWARE\Contoso\Security" -Name "HardeningLevel" -ErrorAction SilentlyContinue
$result["HardeningLevel"] = $regVal ?? 0

# Output JSON (required format)
return $result | ConvertTo-Json -Compress

// Compliance Rule JSON (uploaded to Intune)
{
  "Rules": [
    {
      "SettingName": "CorporateSecurityInstalled",
      "Operator": "IsEquals",
      "DataType": "Boolean",
      "Operand": true,
      "MoreInfoUrl": "https://contoso.com/security/agent",
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Corporate Security Agent Missing",
          "Description": "Install the Corporate Security Agent from the Software Center."
        }
      ]
    },
    {
      "SettingName": "HardeningLevel",
      "Operator": "GreaterEquals",
      "DataType": "Int64",
      "Operand": 2,
      "RemediationStrings": [
        {
          "Language": "en_US",
          "Title": "Hardening Level Too Low",
          "Description": "Run the Hardening script from Software Center to achieve Level 2."
        }
      ]
    }
  ]
}

⚡ Non-Compliance Actions

⏳ Grace Period

🔐 Conditional Access Integration

🤖 Proactive Remediations

💻 Proactive Remediation Script Examples

# DETECTION: Check if Windows Update service is running
$service = Get-Service -Name wuauserv -ErrorAction SilentlyContinue
if ($service.Status -eq "Running") {
    Write-Output "Windows Update service is running"
    exit 0  # Healthy
} else {
    Write-Output "Windows Update service is NOT running"
    exit 1  # Issue detected – trigger remediation
}

# REMEDIATION: Start Windows Update service and set to automatic
try {
    Set-Service -Name wuauserv -StartupType Automatic
    Start-Service -Name wuauserv
    Write-Output "Windows Update service started successfully"
    exit 0  # Remediation successful
} catch {
    Write-Output "Failed to start Windows Update service: $($_.Exception.Message)"
    exit 1  # Remediation failed
}

###################################################
# DETECTION: Check if device timezone is correct
$expectedTZ = "Israel Standard Time"
$currentTZ = (Get-TimeZone).Id
if ($currentTZ -eq $expectedTZ) {
    exit 0
} else {
    Write-Output "Timezone mismatch: $currentTZ"
    exit 1
}

# REMEDIATION: Set correct timezone
Set-TimeZone -Id "Israel Standard Time"
exit 0

📊 Reports & Monitoring

🔧 Troubleshooting

✅ Implementation Checklist