Summary
- Intune will move Windows Health Attestation compliance evaluation from the legacy Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA).
- This is a service-side migration and will occur automatically; admins do not need to deploy a client update.
- Windows 11 compliance policies that depend on Health Attestation signals are affected, especially policies using BitLocker, Secure Boot, or Code Integrity device health settings.
- Admins should review network, firewall, proxy, and endpoint access rules to ensure devices can reach the required Microsoft Azure Attestation endpoints.
- If the required endpoints are blocked, devices can fall out of compliance after the migration completes.
Microsoft Intune is migrating Windows Health Attestation for Windows 11 devices to Microsoft Azure Attestation by the end of March 2027. Administrators must review network and firewall rules to permit access to the new Azure endpoints before the rollout completes. Failure to update network configurations will cause compliance policies relying on health signals to fail.
Administrator impact: Administrators must review network configurations to ensure devices can reach the required Azure Attestation endpoints before March 2027.
End user impact: Windows 11 devices might be marked as noncompliant if required network endpoints are blocked and health policies cannot be evaluated.
Score rationale: This change requires proactive network updates to prevent device compliance failures across the organisation.
Configure endpoints for Azure Attestation migration
Intune will migrate Windows Health Attestation from Device Health Attestation to Microsoft Azure Attestation by early 2027. Organizations must ensure network access to Azure Attestation endpoints to maintain compliance evaluation for Windows 11 devices using health-based policies, or risk compliance failures.
Message ID: MC1473156
Primary Service: Intune
Admin Impact: Medium
User Impact: Low
Release Start: 31 Mar 2027
Release End: 31 Mar 2027
Published: 17 Sept 2026
Expires: 31 Jul 2027
Last updated: 17 Sept 2026
Rollout: March 2027
Services: Intune, Windows
Category: Plan for change
Tags: Admin Action, User Adoption
History
9/16/2026 Item Added to Message Center
Microsoft Message
Microsoft Intune will migrate Windows Health Attestation compliance evaluation from the current Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA). This is an Intune service-side change that will happen automatically.
Rollout schedule
This migration is expected at the end of the first quarter in calendar year 2027.
Impact on your organization
This change affects evaluation of Windows compliance policies that rely on Health Attestation signals. Action is required to avoid interruption. Organizations that do not allow access to the required Azure Attestation endpoints will experience issues with Health Attestation-based compliance evaluation after the migration is completed.
Action required/recommendations
Review your network, firewall, proxy, and endpoint access configurations. Specifically, verify that your environment allows devices to access the required Microsoft Azure Attestation endpoints. For detailed guidance, including the required endpoints and configuration recommendations, refer to: Configure endpoints for Azure Attestation migration.
Compliance considerations
If unaddressed, Windows 11 devices with assigned compliance policies using any of the device health settings (BitLocker, Secure Boot, Code Integrity) will fall out of compliance.