Device Compliance Audit Runbook

Procedure for auditing non-compliant Intune devices and remediating enrollment issues.

When to Run

• Periodically (monthly recommended)
• After discovering a device with login/compliance issues
• When onboarding or offboarding employees

Step 1 — Identify Non-Compliant Devices

1. Go to Intune > Devices > Monitor > Noncompliant devices
2. Export the list
3. For each device, note:
   • Device name
   • Primary user
   • Compliance state
   • Last check-in date

Step 2 — Triage

Categorize each device:

Category	Criteria	Action
Stale/Former employee	User no longer active, device not checked in 30+ days	Delete from Intune + Entra ID (see Offboarding)
Active but non-compliant	User is active, device checked in recently	Request dsregcmd /status from user (see Step 3)
Active but never checked in	User is active, device never enrolled	Likely a registration-vs-join issue, request diagnostics

Step 3 — Request Diagnostics from Active Users

Send the following to affected users:

Hi [Name],

We’re auditing device compliance for our Intune MDM setup. Could you please run the following command on your laptop and send me the output?

1. Open the Start menu and search for Command Prompt
2. Right-click it and select Run as administrator
3. Type the following command and press Enter: dsregcmd /status
4. Select all the output text (Ctrl+A), copy it (Ctrl+C), and paste it in a reply to this email

This helps us verify your device is properly enrolled and receiving security policies.

Thanks, Leon

Step 4 — Analyze Results

For each response, check:

Field	Expected	Action if Wrong
AzureAdJoined	YES	Follow Azure AD Join Guide
AzureAdPrt	YES	Will resolve after proper Azure AD Join
WorkplaceMdmUrl	Populated	Will resolve after proper Azure AD Join
WorkplaceTenantName	Authentica Solutions	Investigate — may be joined to wrong tenant

Step 5 — Remediate

• For registered-only devices: Send the Azure AD Join guide and walk the user through it
• For stale devices: Delete from Intune and Entra ID
• For wrong tenant: Disconnect and rejoin to correct tenant

Step 6 — Verify and Close

After remediation:

1. Have user run dsregcmd /status again to confirm AzureAdJoined = YES
2. Check Intune to confirm device appears as compliant
3. Update the investigation in control-center: cctl investigate add-note intune-device-compliance-and-remote-management "<outcome>"

History

Date	Event
2026-02-27	Rohan Shanker laptop login failure exposed registration-vs-join issue
2026-03-03	Root cause confirmed via dsregcmd — device Workplace Registered only. Azure AD Join how-to sent to Rohan. Audit of remaining non-compliant devices initiated.