Explanation:

Device Compliance settings for Windows 10/11 in Intune

As part of your mobile device management (MDM) solution, use these settings to require BitLocker, set a minimum and maximum operating system, set a risk level using Microsoft Defender for Endpoint, and more.

Box 1: Device Health

Device Health

Windows Health Attestation Service evaluation rules

Require BitLocker:

Windows BitLocker Drive Encryption encrypts all data stored on the Windows operating system volume. BitLocker uses the Trusted Platform Module (TPM) to help protect the Windows operating system and user data. It also helps confirm that a computer isn’t tampered with, even if its left unattended, lost, or stolen. If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys can’t be accessed until the TPM verifies the state of the computer.

Not configured (default) – This setting isn’t evaluated for compliance or non-compliance. Require – The device can protect data that’s stored on the drive from unauthorized access when the system is off, or hibernates.

Box 2: Device Properties

Requires a minimum operating system version

Device Properties

Operating System Version

To discover build versions for all Windows 10/11 Feature Updates and Cumulative Updates (to be used in some of the fields below), see Windows release information. Be sure to include the appropriate version prefix before the build numbers, like 10.0 for Windows 10 as the following examples illustrate.

Minimum OS version:

Enter the minimum allowed version in the major.minor.build.revision number format. To get the correct value, open a command prompt, and type ver.

Etc.

Reference: https://learn.microsoft.com/en-us/mem/intune/protect/compliance-policy-create-windows

Explanation:

Box 1: Yes

Device1 has BitLocker enabled.

Device1 is member of Group1.

We see for Policy1:

Require BitLocker

Included groups: Group1, Group3

Excluded groups: Group2

Box 2: No

Device2 has BitLocker disabled.

Device2 is member of Group1 and Group3.

Box 3: No

Device3 has BitLocker enabled.

Device3 is member of Group1, Group2.

Group1 is included, while Group2 is excluded.

Note: Exclusion takes precedence over inclusion in the following same group type scenarios:

Including user groups and excluding user groups when assigning apps Including device groups and excluding device group when assigning apps

Reference:

https://learn.microsoft.com/en-us/mem/intune/protect/device-compliance-get-started

https://docs.microsoft.com/en-us/intune/apps/apps-inc-exl-assignments