Intune now supports client-driven compliance evaluation for Windows devices
Intune now supports client-driven compliance evaluation for Windows devices
Windows devices enrolled in Intune can now detect changes to specific compliance signals and request a compliance reevaluation immediately, rather than waiting for a scheduled check-in. Administrators managing Windows compliance policies should understand which signals trigger this behavior and how throttling affects it.
Intune now supports client-driven compliance evaluation for Windows devices. Two mechanisms are documented:
Scheduled compliance monitoring: The Intune Management Extension (IME) periodically monitors compliance-related settings locally. If the current values differ from the previously known baseline, the device initiates a check-in with Intune, which triggers a compliance evaluation.
Real-time compliance monitoring: For the following settings, Intune detects changes as they occur and proactively requests a device check-in:
- Firewall
- Antivirus
- BitLocker
- Microsoft Defender status
- Operating system build version
- Real-time protection (RTP)
- Secure Boot
Compliance policies are also evaluated during device check-in when a calculation is triggered. To maintain service reliability, Intune applies built-in throttling for compliance-triggered reevaluations. If multiple changes occur in a short period, some updates may be processed during subsequent evaluation cycles.
The source states this applies to Windows devices. It does not specify which enrollment types, management scopes, or Intune tenant configurations are required for the feature to be active. Faster reevaluation affects remediation, reporting, and access decisions, as stated by the source. Throttling means that not every change results in an immediate reevaluation cycle.
Listed under the week of September 14, 2026 in the Intune What's New page. The source does not give a specific rollout start or completion date. The general rollout note on the What's New page states that monthly service updates roll out gradually over several days to a week, and some tenants may see changes before others.
The source states this applies to Windows devices. It does not specify a licensing tier, a minimum Windows version, an enrollment type, or any additional configuration requirement beyond what is already needed to create a compliance policy in Intune.
- Review the seven real-time monitored signals (Firewall, Antivirus, BitLocker, Microsoft Defender status, OS build version, Real-time protection, Secure Boot) against your existing Windows compliance policies to confirm they are configured as expected.
- Check whether your compliance policies include these signals; devices will now reevaluate them faster, which may surface previously slow-to-appear non-compliance states in reporting and Conditional Access.
- Account for throttling behavior: if a device triggers multiple signal changes in a short period, not all changes will produce an immediate reevaluation. Review how your remediation workflows handle deferred evaluation cycles.
- See the updated compliance policy documentation linked in the source ("Create a compliance policy in Microsoft Intune" and "Device compliance settings for Windows in Intune") for full trigger and calculation details.
My read is that this change introduces two distinct layers: a real-time event-driven path for the seven listed signals, and a scheduled polling path via the IME for everything else. The throttling note is worth noting architecturally: the feature does not guarantee that every signal change produces a separate evaluation cycle, only that supported changes are processed faster than periodic polling alone would allow. The practical effect on Conditional Access latency will depend on how quickly the reevaluation reaches the compliance service and how Conditional Access caches compliance state, neither of which the source addresses.
I would treat the seven real-time signals as the higher-priority settings to audit in your compliance policies, since they now affect access decisions faster than before. If your environment uses Conditional Access policies gated on device compliance, check that your grace period and re-evaluation settings remain appropriate given that non-compliance can now be reported more quickly.
- learn.microsoft.com/en-us/intune/intune-service/fundamentals/whats-new
- learn.microsoft.com/en-us/intune/intune-service/protect/compliance-policy-create-windows
The source covers the feature announcement (What's New, week of September 14, 2026) and the compliance trigger mechanics (Device compliance settings for Windows in Intune); it does not cover licensing requirements, supported enrollment types, minimum Windows version, or Conditional Access interaction details.