The goal is to ensure access is only granted to devices with trusted firmware and operating system (OS) builds. Each compliance setting addresses this requirement for a specific platform: Device1 (Windows 10): The Require Secure Boot setting uses Windows Device Health Attestation to verify that the device's boot process is secure and has not been tampered with by untrusted software. This directly confirms the integrity of the device's firmware and boot-time components. Device2 (iOS): A jailbroken device has had its operating system security restrictions removed, allowing unverified apps to run and potentially compromising the OS integrity. Blocking jailbroken devices ensures that only trusted iOS builds can access resources. Device3 (Android Enterprise): Rooting an Android device grants privileged (root) access, which bypasses the standard security model of the OS. This makes the operating system build untrusted. Blocking rooted devices is the correct control to maintain OS integrity. Incorrect Options: Require BitLocker: This setting enforces data encryption on the device's storage. While it is a critical data protection control, it does not verify the integrity of the firmware or the operating system's boot process. A device could have BitLocker enabled but still have its boot process compromised if Secure Boot is disabled.

Windows 10/11 Compliance Settings:

Microsoft Learn: "Windows 10/11 and later settings to mark devices as compliant or not compliant in Intune". Under the Device Health section, it lists "Require Secure Boot to be enabled on the device."

URL: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-createwindows#device-health

Reference: Section: Device Health, Setting: Require Secure Boot to be enabled on the device.

iOS/iPadOS Compliance Settings:

Microsoft Learn: "iOS/iPadOS settings for compliance policies in Microsoft Intune". This document details the settings for iOS devices.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-createios#device-health

Reference: Section: Device Health, Setting: Jailbroken devices. The description states this checks if devices are jailbroken and setting it to Block marks them as not compliant.

Android Enterprise Compliance Settings:

Microsoft Learn: "Android Enterprise settings to mark devices as compliant or not compliant using Intune". This document covers compliance for Android Enterprise.

URL: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-createandroid-enterprise#device-health

Reference: Section: Device Health, Setting: Rooted devices. This policy checks for root access and can Block devices that are rooted.