Enrollment and compliance answer different questions.
Intune enrollment identifies a management relationship. Compliance describes evaluation against selected requirements. A device can be enrolled while its compliance state is unknown, in progress or noncompliant.
The published EasyNAC compatibility guide lists Microsoft Intune Cloud. Confirm tenant, permissions and the specific management or compliance information available through your EasyNAC connector.
Use the connector’s supported management information with the access requirements defined for your environment. Management, enrollment and health are different kinds of evidence. Confirm which supported policy conditions apply to this connector rather than treating it as an interchangeable XDR source.
Connect the integration.
- Deploy the EasyNAC appliance or VM, configure its IP and review discovered devices.
- Prepare the registered application’s tenant ID, client ID and client secret, and select the Microsoft cloud environment for your tenant. Configure the required permissions, set the query interval and test the connection.
- Confirm the managed-device recognition used by default Auto Trust, then select any additional documented health conditions required by your access policy.
- Use a managed test endpoint and an unapproved test device to verify access, restrictions and recovery.
Recognize enrollment, identity and compliance states.
The EasyNAC Intune connector documents separate tags for:
- Microsoft Entra joined or hybrid joined devices.
- Microsoft Entra registered devices.
- Intune enrolled or pre-enrolled devices.
- Managed devices considered noncompliant by Microsoft Entra ID or Intune.
- Devices reported by Intune as jailbroken or rooted.
Enrollment and compliance are separate conditions. A managed device can be recognized while its reported noncompliance produces a different access outcome.
Connect the correct Microsoft tenant and cloud.
Setup uses an application registered in Microsoft Entra ID, with its tenant ID, client ID and client secret. The connector offers Commercial / GCC, GCC High and DoD customer-type selections, which choose the corresponding Microsoft login and Graph endpoints.
The connector applies tags when enabled conditions match the information reported by the source. EasyNAC uses those tags in Auto Trust and role-based access decisions. Managed-device recognition and additional health requirements serve different purposes: the resulting access follows the policy in use.
Checks refresh on the configured query interval; they are not an instantaneous live assessment of every endpoint. After correcting a condition, confirm the source has reported the change and EasyNAC has refreshed its information before checking restored access.
Prove the access outcome.
| Pilot case | What to demonstrate |
|---|---|
| Identity and enrollment | Verify the appropriate Entra joined/registered or Intune enrolled/pre-enrolled tag on a known device. |
| Noncompliance | Use an approved source-reported noncompliant test record and verify its tag and configured access outcome. |
| Rooted or jailbroken status | Where applicable, validate the documented Intune-reported condition using an approved test device or record. |
| Recovery and reporting | Remediate the condition, allow Intune to report and verify the refreshed EasyNAC access decision. |
Record the source condition, EasyNAC tag, policy reason and access result in the Evaluation Kit scorecard. Agree the test and recovery procedure with your security team before changing endpoint conditions.
Keep the integration useful after deployment.
Coordinate tenant permissions, device-record cleanup, reporting freshness and relevant connector updates with the Intune administrator. Preserve the management services needed to complete enrollment or remediation in your restricted-access plan.
Expand only after the first network’s device matching, access and recovery behavior is understood. Review EasyNAC appliances, remote Enforcer Sensors and optional CVM when planning branches or regions.
Common questions.
Can EasyNAC distinguish Intune enrollment from noncompliance?
Yes. Enrolled/pre-enrolled status and source-reported noncompliance are separate documented connector conditions.
Which Microsoft cloud environments can be selected?
The connector provides Commercial / GCC, GCC High and DoD options. Choose the option that matches the tenant and its Microsoft endpoints.
Sources and deployment scope.
Prepared by InfoExpress, Inc., the company behind EasyNAC. The connector checks described here were verified against the EasyNAC appliance help on 14 October 2026. Product API references provide source-platform background. Confirm availability for your connector version and source-product configuration.
Test it on your network.
Agree the requirements, connect a representative endpoint and record the actual result.