How to roll out your compliance rules
Published: May 31, 2023 | Author: René Laas
The purpose of this blog post is to inform you how to roll out your compliance policy rules to your organization.
We all agree that configuring a compliance policy is essential for several reasons. I always advised implementing compliance policies. For example, it helps to protect users to get access to data on non-corporate devices in combination with Conditional Access. But in the past, I never thought about the business needs. So, I created a blog post about it, please check out this blog post before you start implementing Compliance rules.
In this blog, I will explain how to roll out your compliance rules that are translated and based on the business compliance rules. In my next blog post, I will explain how to configure Compliance rules within Intune.
Compliance rules and why are those rules required?
Intune compliance rules are a set of policies that define the security and compliance standards for your organization and the devices managed by Intune. This can be corporate or personal devices.
These compliance rules enable you or the Intune or security administrator to enforce the requirements and restrictions on devices to meet organizational security and compliance objectives.
Compliance rules help organizations maintain a secure environment by enforcing necessary security measures on devices, users, and applications. By setting rules like disk encryption or passcode complexity. Also, Compliance rules contribute to data protection by ensuring that devices and applications accessing corporate resources meet to the specific security standards.
In my previous blog post, I already explained that compliance rules help organizations to comply with regulatory requirements and industry standards. For example, defining rules aligned with regulations like GDPR (General Data Protection Regulation).
Overall, Intune compliance rules are an essential component of the Intune management solution. These rules enable organizations to enforce security standards, protect data, comply with regulations, safeguard corporate resources, and maintain consistency in their device and application management. By utilizing Intune compliance rules effectively, organizations can enhance their overall security posture and minimize the risks associated with mobile devices and applications.
Roll-out strategy
1. Define your compliance rules and processes
Start with defining your compliance rules. Please check out my previous blog post for an approach. But if you have already defined your compliance rules you also must think of about processes and actions. What if someone become not compliant, which action should we do, etc.? Something like sending an e-mail to end user when a device become non-compliant. Do we want to block non-compliant devices that can result in less productivity etc. It’s important to think off several scenarios before you implement compliance rules.
2. Get a sign of your sponsors within your business
When your compliance rules are defined, get a sign of. In some organizations, you must deal with work councils. Get them involved during the creation and get approval from all your sponsors so your back is covered.
3. Define your POC and Pilot team
When selecting POC and pilot users, look for users who are willing to actively participate, provide feedback, and collaborate with you throughout the POC and pilot phase. It’s crucial to have a diverse group of POC and pilot users to gather insights and validate your compliance rules from different user/ business perspectives.
4. Start with a Proof of Concept
Start with a small POC team. Understand how compliance rules works. Ask your test users to break your compliance rules and test your processes etc.
5. Get Feedback from POC users
Ask your POC users for feedback, ask for feedback. What did they do to fix it etc. you can learn already a lot from your pilot before you go to production.
6. Learn from the feedback of your POC users
Learn and act from the feedback. For example, create some FAQ articles for your support desk or users.
7. Tweak your compliance rules based on the feedback
Based on the feedback of your POC users, change if needed your compliance rules, actions, or processes.
8. Start with a Pilot roll-out
Start with a larger pilot team. Ask some of your pilot users to break your compliance rules again to test your changes in your compliance rules, actions, or processes.
9. Tweak your compliance rules, actions, or processes based on the feedback from Pilot
Based on the feedback of your Pilot users, change if needed your compliance rules, actions, or processes. If no action needed; you are ready to roll out to production.
10. Roll out to Production in rings
Roll out your compliance rules in several rings. If you want to know more about rings, check out the following blog posts; Create dynamic groups with an increasing number of users and Creating randomly populated groups with azure AD dynamic groups
Summarize
In conclusion, rolling out compliance rules is a crucial step in ensuring the security and compliance of your organization. This blog post has highlighted the importance of compliance rules and provided my step-by-step guide to help you with a roll out.
It is essential to define your compliance rules and processes, considering various scenarios and actions for non-compliance. Get a sign-off from sponsors and involving relevant stakeholders, such as work councils, is also necessary to ensure support and coverage.
Next, forming a POC and pilot team consisting of diverse users who actively participate and provide feedback is crucial. Conducting a Proof of Concept allows you to understand how compliance rules work and test your processes, while gathering valuable insights from user feedback.
Learning from the feedback received during the POC phase, you can tweak and refine your compliance rules, actions, or processes as necessary. Creating FAQ articles based on user experiences can enhance support for your compliance rules.
Moving forward, a larger pilot rollout allows you to further test and validate your compliance rules, ensuring any required changes are made before proceeding to production. Finally, rolling out your compliance rules in stages or rings..
By following these steps, you can successfully roll out compliance rules within your organization, enabling you to enforce security standards, protect data, comply with regulations, and maintain consistency in device and application management. Compliance rules contributes to improve your overall security posture.
Hi! My name is René Laas. I have passion and enthusiasm for the Microsoft 365 Cloud. I am based in the Netherlands.
Rami Al-zayat 
Albert Stoynov
Andrea De Santis
Tingey Injury Law Firm
Gerd Altmann
Leave a Reply
Want to join the discussion?Feel free to contribute!