Does non-compliant iOS status affect kiosk mode or Microsoft 365 access?Solved

Hi @jaxon_r ,

Marking an iOS device as non-compliant in Hexnode UEM is an administrative compliance status in the Hexnode UEM portal. By itself, this status does not interrupt an active iOS kiosk session or stop the app currently running in kiosk mode.

So, in your example, if an iPad is running a timeclock app in kiosk mode and the device becomes non-compliant, the kiosk session continues to run for the end user. The non-compliant status serves as an alert for admins to review and remediate the compliance issue.

For Microsoft 365 app access, Hexnode UEM does not directly block Outlook, OneDrive, SharePoint, Teams, or similar apps. Hexnode UEM evaluates the device against your configured compliance rules and syncs the device compliance state to Microsoft Entra ID. Access enforcement is then handled by Microsoft Entra Conditional Access policies.

In short:

• Hexnode UEM determines and reports whether the device is compliant or non-compliant.
• Microsoft Entra ID evaluates that status during sign-in.
• Conditional Access decides whether to allow or block access to Microsoft 365 apps based on your policy configuration.

Regards,
Isabel Lora
Hexnode UEM

That helps. So if we have regular Hexnode policies for apps that aren’t Microsoft work apps, those should continue working even if the device is marked non-compliant, right? The blocking only happens if Entra Conditional Access is configured to use Hexnode’s compliance status?

Correct. General Hexnode UEM policy behavior does not automatically stop just because a device is marked non-compliant, unless you have configured a specific workflow or enforcement action around that state.

For Microsoft app restrictions, the key component is the Microsoft Entra integration. Hexnode UEM syncs the device’s compliance state to Entra ID through Microsoft’s Partner Compliance Connector API. When the user signs in to a Microsoft 365 app or another app protected by Entra ID, Entra checks the synced compliance status against your Conditional Access policy.

If the Conditional Access policy requires a compliant device:

• A compliant device is allowed access.
• A non-compliant device is blocked until compliance is restored.

This can apply to Microsoft 365 apps and also to third-party apps that are connected to your Entra directory and protected by Conditional Access.

Regards,
Isabel Lora
Hexnode UEM

Got it @isabel_lora. We’re in the process of linking Hexnode with Entra ID, so I wanted to make sure non-compliance wouldn’t suddenly break kiosk devices, and that Microsoft access control is really coming from Entra policies.

Yes, @jaxon_r .

A good rollout approach is to configure the Hexnode compliance rules first, then test the Hexnode-Entra integration with a small pilot group before applying Conditional Access broadly. That way, you can confirm that compliance status is syncing as expected and that your Conditional Access rules only block access in the scenarios you intend.

For kiosk devices specifically, the non-compliant status alone will not end the kiosk session. Any access restriction to Microsoft apps depends on your Entra Conditional Access configuration.

Regards,
Isabel Lora
Hexnode UEM