Intune adds client-driven compliance evaluation for Windows (Preview)
Seven specific compliance signals on Windows devices now trigger a re-evaluation in near real time instead of waiting for the next scheduled check-in. Everything else still runs on the old cycle, and there's built-in throttling most write-ups have missed.
A device gets remediated, BitLocker finishes encrypting, the firewall gets turned back on, and the user still sits blocked from Microsoft 365 because Intune hasn’t caught up yet. Microsoft’s new capability targets that specific wait, for seven signals, not for compliance policy in general (What’s new in Microsoft Intune, week of September 14, 2026).
Key Takeaways
- Windows devices can now proactively request a compliance re-evaluation the moment a supported signal changes, instead of waiting for the next scheduled check-in
- Only seven specific signals get this fast path: Firewall, Antivirus, BitLocker, Microsoft Defender status, OS build version, Real-time protection, Secure Boot
- Everything else, including custom compliance scripts, still relies on the existing Intune Management Extension’s periodic scheduled monitoring
- Intune throttles compliance-triggered re-evaluations, so a burst of changes in a short window doesn’t all land instantly
- No extra licensing required beyond your existing Intune subscription
The seven signals
- Firewall
- Antivirus
- BitLocker
- Microsoft Defender status
- Operating system build version
- Real-time protection (RTP)
- Secure Boot
Change one of these on a supported Windows device and Intune detects it, requesting a check-in on its own rather than waiting for the next scheduled sync.
What it doesn’t do
This isn’t Intune compliance getting faster across the board, it’s a fast lane next to the existing slow lane, open to exactly these seven settings. A custom compliance script, a Configuration Manager co-management setting, or anything outside this list still moves at the old speed. Microsoft also documents throttling: “If multiple changes occur in a short period, some updates might be processed during subsequent evaluation cycles.” A remediation script that fixes BitLocker, the firewall, and Defender in one run won’t necessarily get three instant re-evaluations.
What you need to do
Nothing to configure, it applies automatically to supported Windows devices. Two things worth doing:
- Update internal docs or helpdesk scripts that describe compliance sync as purely schedule-based. For these seven signals, that’s no longer accurate.
- Don’t expect it to fix delays outside the list. Check whether a slow-updating rule is one of the seven before assuming something’s broken.
Frequently asked questions
Do we need a new license for this? No. Your existing Intune subscription covers it. Conditional Access with compliance status still needs Entra ID P1/P2 as before, unrelated to this change.
Does this cover custom compliance scripts? No. The real-time list is limited to the seven named settings; custom scripts still rely on the existing scheduled monitoring cycle.
Will this flood us with check-ins if several settings change at once? No, built-in throttling applies. Not every change in a short window triggers an immediate re-evaluation; some fall back to the next scheduled cycle.