Intune passcode enforcement failures on Android devices typically stem from misconfigured device restriction policies, conflicting compliance settings, or outdated management agents. Verify that the correct policy scope is applied and that the "Require password" setting is explicitly enabled within the Android Enterprise restrictions profile to resolve non-compliance reports.
Verify Device Restriction Policy Configuration
The most common cause for passcode enforcement issues in Microsoft Intune is an incomplete or incorrectly scoped device restriction policy. You must ensure that the specific configuration profile targeting your Android devices includes the mandatory password requirements. Navigate to the Microsoft Intune admin center and select Device configuration followed by Profiles. Locate the profile intended for your Android Enterprise or Android Corporate Owned devices.
Within the profile settings, expand the Restrictions section and look for the Password subsection. Here, you must explicitly set Require password to Yes. Additionally, verify that the minimum password length and complexity requirements are defined according to your security standards. If these fields are left blank or set to No, Intune will not enforce a passcode, leading to the non-compliant status observed across your device fleet. Save the changes and ensure the assignment groups include the affected devices.
Check Compliance Policy Interactions
Device restrictions and compliance policies operate independently but can sometimes conflict if not aligned correctly. A compliance policy defines what constitutes a compliant device, while a restriction policy dictates how the device behaves. If a compliance policy requires a password but does not link to a restriction policy that enforces it, the device may appear non-compliant without actually being locked out by the system.
Review your Compliance policies under the Device compliance menu. Ensure that the Password requirement is checked in the platform-specific settings for Android. More importantly, check the Remediation tab of this policy. If the policy is set to block access for non-compliant devices, but no restriction policy is actively pushing the password requirement, users might bypass the prompt or the device might fail to sync the correct state. Linking the compliance policy to the specific device restriction profile ensures that the enforcement mechanism is active when a violation is detected.
Validate Agent Version and Management Mode
Android Enterprise devices rely on the Company Portal app and the Managed Google Play framework to enforce restrictions. Older versions of the Company Portal app may have bugs related to passcode synchronization, especially after major Android OS updates. Check the version of the Company Portal app installed on a few representative non-compliant devices. If the version is significantly behind the latest release available in the Google Play Store, update the app via the store or through Intune's app deployment.
Furthermore, confirm that the devices are enrolled using the correct management mode. For fully managed devices, restrictions are enforced more strictly than for work profiles. If you are using a work profile setup, ensure that the restriction policy is specifically configured for the work profile container. Inconsistent management modes can lead to scenarios where restrictions are ignored because the agent interprets the policy context incorrectly. Restarting the Company Portal app and forcing a compliance check often resolves temporary synchronization glitches.
Force Compliance Check and Review Audit Logs
After making configuration changes, Intune does not always push updates immediately. You should force a compliance check on the affected devices to accelerate the synchronization process. Instruct users to open the Company Portal app, navigate to Device health, and tap Sync or Check compliance. This action triggers an immediate evaluation of the device against the assigned policies.
To verify if the issue has been resolved, review the Audit logs in the Intune admin center. Look for events related to Device compliance and filter by the specific device IDs. Successful enforcement will show a transition from Non-compliant to Compliant with details indicating that the password requirement was met. If the status remains non-compliant, download the detailed error report to identify if a specific setting is causing the failure. This step confirms whether the policy changes were successfully applied and processed by the device agent.
Address Edge Cases and Known Issues
In rare instances, custom ROMs or heavily modified Android skins may ignore standard Android Enterprise restrictions. These modifications can strip away the necessary hooks that Intune uses to enforce passcodes. If you manage a fleet with diverse device manufacturers, test the policy on a clean, stock Android device first to isolate OEM-specific issues. Additionally, ensure that any third-party security apps installed on the device do not interfere with the passcode entry interface, as some keyboard apps or security suites can block the system password dialog.
If the problem persists despite correct configuration, consider creating a new device restriction profile with minimal settings to rule out complex inheritance issues. Sometimes, nested group assignments or overlapping policies can cause the most restrictive setting to be overridden by a less restrictive one due to precedence rules. By simplifying the policy structure, you can determine if the issue lies in the policy logic rather than the device itself. For deeper technical troubleshooting, reviewing the MDM diagnostic logs on the device can provide insight into why the restriction commands are being rejected or ignored by the operating system.
Frequently Asked Questions
Why do some Android devices remain non-compliant after updating the policy?
Devices may cache old policy states and require a manual sync to recognize changes. Users should open the Company Portal app and manually trigger a compliance check to force the device to re-evaluate its status against the updated restrictions.
Can I enforce a passcode without requiring a specific complexity level?
Yes, you can configure the device restriction policy to require only a simple numeric PIN without alphanumeric complexity. In the Password settings, you can set the minimum length to four digits and disable the requirement for mixed characters, which is useful for user convenience while maintaining basic security.
Does Android Enterprise Work Profile support the same passcode restrictions as fully managed devices?
Work profiles have limited restriction capabilities compared to fully managed devices. While you can require a password for the work profile, some advanced restrictions like encryption or screen lock timeouts may not apply uniformly. Always verify the specific limitations of the Work Profile model in the Intune documentation.
What happens if a user forgets their Intune-enforced passcode?
If the passcode is forgotten, the device may become inaccessible unless there is a backup method such as a secondary authentication factor or enterprise-wide reset capability. In fully managed devices, IT administrators can sometimes perform a remote wipe, but this data loss risk makes strong passcode recovery procedures essential.
How can I check which devices are failing the passcode check?
You can use the Intune reporting dashboard to view device compliance status. Filter the report by Android and Non-compliant categories, then drill down into the specific compliance items to see if the passcode requirement is listed as the failed condition. This helps identify if the issue is widespread or isolated to specific models.