Configuring a device compliance policy

In Chapter 6, Administration and Policy Management, we reviewed device compliance policies in MEM and how they help attest to conditions as part of the zero-trust strategy and ensure a device meets the company requirements before being marked as compliant. We covered the actions that can be taken for devices marked as non-compliant and provided recommendations for which conditions to evaluate against. In this example, we will create a policy that evaluates if hardware security features are enabled on a device by checking if BitLocker encryption is enabled, a TPM is present, and Secure Boot is enabled. Let's get started:

1. Log into Microsoft Endpoint Manager at https://endpoint.microsoft.com.
2. Choose Device and click Compliance policies.
3. Click Create Policy, select Windows 10 and later as the platform type, and click Create.
4. Give it a name, such as Windows Device Health Compliance, and a description and click Next.
5. Choose...