Intune Custom Compliance Scripts May Rerun Hourly, Not Every Eight Hours
A newer Intune Management Extension build shows evidence of re-evaluating custom compliance discovery scripts roughly every hour instead of the documented eight, but Microsoft has not confirmed or documented the change. Here is what MSPs relying on custom compliance for Conditional Access should do.
Microsoft Intune's documentation has said the same thing for years: custom compliance discovery scripts are checked and re-run every eight hours, and it can take up to eight hours for a fixed device to show compliant again. That number is quietly being tested by evidence pulled from inside a newer Intune Management Extension build.
Independent analysis of Intune Management Extension version 1.103.101.0 has turned up new scheduling code inside the extension, including a flag referencing an hourly cadence for the compliance script workload. Registry and log evidence suggests some devices running this build have their custom compliance discovery scripts re-evaluated roughly once an hour, with the changed result reported back to Intune through the same policy result path that has always existed. Nothing about the JSON schema, the script format, or how results reach Conditional Access appears to have changed.
Two things worth holding onto
- This is client-side behavior spotted through binary and log analysis, not a Microsoft announcement, preview note, or roadmap entry.
- Microsoft Learn's custom compliance documentation still states, unchanged as of this writing, that scripts are checked and re-run every eight hours, and that it can take up to eight hours for a resolved issue to register as compliant.
Why this matters for multi-tenant baselines
For MSPs, that eight-hour figure is not an abstraction. Any baseline check built on custom compliance, rather than a built-in Intune setting, inherits whatever the real-world re-evaluation interval turns out to be on a given device. That interval decides how long a device stays locked out of Conditional Access protected resources after a technician has already fixed the underlying problem, and how long a customer keeps asking why a device that is fixed still shows noncompliant.
Until Microsoft documents a shorter interval, treat any faster cadence you observe as a bonus, not a guarantee. Do not rewrite customer SLAs around it, and do not assume every tenant or every device is running the newer extension build.
Worth checking this week: pull the Intune Management Extension version and script report timestamps on a handful of devices across a few tenants and see what cadence you are actually getting. What does your own fleet show?