Intune will move Windows health attestation compliance evaluation from Device Health Attestation to Microsoft Azure Attestation at the end of Q1 2027. Windows 11 devices with BitLocker, Secure Boot or Code Integrity settings fall out of compliance if they cannot reach their tenant’s intunemaape*.attest.azure.net host, and TLS inspection on that traffic breaks attestation even when port 443 is open.
