Plan for Change: Intune migration for Windows Health Attestation to Microsoft Azure Attestation for Windows 11 devices

🚨 The Signal: Intune will switch from Device Health Attestation to Azure Attestation for Windows 11 compliance by Q1 2027. Network access to new Azure endpoints is required to maintain device compliance.

The Impact

Windows 11 devices relying on Health Attestation will become non-compliant if network access to Azure Attestation endpoints is not configured, posing a security risk.

• Security Teams: Risk of non-compliant devices if network access is not updated.
• Admins: Required network configuration changes to maintain device compliance.
• End Users: Potential loss of access to resources if devices become non-compliant.

The Action

1. Review current network, firewall, and proxy configurations for Windows 11 devices.
2. Identify all required Microsoft Azure Attestation endpoints as per Microsoft guidance.
3. Configure network devices and policies to allow outbound access to the specified Azure Attestation endpoints.
4. Validate connectivity from Windows 11 devices to the new Azure Attestation service.
5. Monitor device compliance reports in Intune post-migration to ensure successful attestation.

Domain: Intune · Impact: high · Workload: Intune