Device posture (Windows computer compliance)

Protected Windows computers report their state every 15 minutes. The compliance profile decides which state counts as "compliant", and policies can refuse sign-ins from non-compliant computers.

How do I set the profile?

1. Open «Manage» › «Computers» › «Compliance profile». The console explains: «What a computer must report to count as compliant. Policies can require a compliant, managed or trusted device.»
2. Choose the requirements:
   • «Disk encryption (BitLocker)»
   • «Secure Boot»
   • «Firewall on»
   • «Antimalware real-time protection»
   • «Windows updates at most (days)»
   • «Antimalware signatures at most (days)»
   • «Minimum agent version»
   • «Allowed domains (AD DNS domain or Entra tenant id, one per line)»
3. Choose «Save profile».

The computer list shows the «Compliance» column and, for those that fail, the reason (for example «disk not encrypted» or «Secure Boot off»).

How do I use compliance in a policy?

Windows sign-in rules use the audience authguard.desktop. Useful conditions:

• { "type": "device_posture_any", "values": ["non_compliant"] } in a deny rule;
• device_trust_any (trusted only for computers with their key in the TPM);
• device_managed.

A policy refusal is handled before the phone is contacted: the phone never receives the request.

Cautions

• The state is self-reported by the computer's agent («Self-reported»). It does not replace a device management tool.
• Test the rule with «Test decision» and run it first as a candidate: an overly strict rule can stop everyone signing in. The break-glass account stays available offline.