Others

Can a Noncompliant Windows Device Enroll in Microsoft Intune?

Maira Mehtab Oct 21, 2026 868 views

Question details

The user wants to know if a Windows device that currently lacks compliance requirements, such as having BitLocker enabled, can still be enrolled into Microsoft Intune via Group Policy.

Can a Noncompliant Windows Device Enroll in Microsoft Intune?

Product: Microsoft Intune
Device & OS: Windows
Scenario: Automatically enrolling enterprise Windows devices into Microsoft Intune using Active Directory Group Policy.
Observed behavior: The administrator needs to confirm if enrollment will proceed or be blocked before the BitLocker compliance requirement is satisfied.

Before you start

Ensure you have administrative access to your organization's Microsoft Endpoint Manager admin center and Active Directory Group Policy management tools.

Solution 1Recommended

Understand the Separation of Intune Enrollment and Compliance

Enrollment and compliance evaluation are handled as two distinct processes, allowing noncompliant devices to enroll first.

In Microsoft Intune, a device can successfully enroll even if it does not currently meet all assigned compliance policies, such as BitLocker encryption requirements. The enrollment process typically happens first, allowing the device to register and connect to Intune.

Once enrolled, Intune evaluates the device against your assigned compliance policies. If the device does not meet the requirements, it will be marked as noncompliant based on its current state, at which point remediation (like enabling BitLocker) can take place.

Verify Group Policy Enrollment Settings

Check your Group Policy configuration for automatic MDM enrollment. Devices will trigger the scheduled enrollment task regardless of their initial compliance state.

Monitor Enrollment in Endpoint Manager

After the device enrolls, log in to the Microsoft Endpoint Manager admin center. Navigate to Devices > Windows > Windows devices to confirm the device appears in your inventory.

Check the Device Compliance Status

Click on the newly enrolled device and select 'Device compliance'. It may be flagged as 'Not compliant' until the required BitLocker encryption is fully processed and reported back to Intune.

Understand the Separation of Intune Enrollment and Compliance

Tenant-Specific Enrollment Issues: If you experience specific blockers during enrollment, it may be due to tenant-specific Conditional Access policies. For complex tenant issues, consult the dedicated Microsoft Intune Enrollment community.

Free Microsoft Office alternative

Deploy WPS Office to Your Managed Devices

While managing device configurations and compliance in Microsoft Intune, you may also need a cost-effective productivity suite for your endpoints. WPS Office offers a powerful, lightweight, and highly compatible alternative to Microsoft Office, easily deployable across your organization's managed devices.

1. Download the Installer: Visit the official WPS Office website and download the latest setup file for Windows.
2. Deploy via Intune: Package the WPS Office installer as a Win32 app and deploy it to your enrolled devices through the Microsoft Endpoint Manager admin center.
3. Edit Seamlessly: Users can immediately open, edit, and save their existing Microsoft Office files with perfect formatting retention.

Seamlessly compatible with Microsoft Word, Excel, and PowerPoint formats (.docx, .xlsx, .pptx)Lightweight application that requires minimal system resources on enrolled Windows devicesFree to use with a familiar, user-friendly interface that reduces employee training timeEasy to package and deploy across your enterprise network using Microsoft Intune

microsoft office alternative - wps office

Frequently Asked Questions

Does BitLocker need to be enabled before Intune enrollment?

No. BitLocker encryption is typically a compliance requirement rather than a prerequisite for enrollment. A device can enroll first, after which Intune will evaluate its compliance and prompt the necessary actions to enable BitLocker.

Can Conditional Access block Intune enrollment for noncompliant devices?

Conditional Access policies generally apply to accessing corporate resources (like Exchange or SharePoint) after a device is enrolled. Microsoft recommends excluding Intune enrollment apps from blocking Conditional Access policies to prevent enrollment failures.

How do I troubleshoot Windows automatic enrollment failures via Group Policy?

You can troubleshoot automatic enrollment issues by checking the Event Viewer on the Windows device. Navigate to Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin to view specific error codes.

Office Quick Solutions