Summary
- Microsoft Intune is changing Windows Health Attestation compliance evaluation from the current Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA).
- This is a service-side migration and will occur automatically; no manual tenant-side migration is described.
- Windows compliance policies that rely on Health Attestation signals are affected, especially those using BitLocker, Secure Boot, or Code Integrity device health settings.
- Administrators must verify network, firewall, proxy, and endpoint access so devices can reach the required Microsoft Azure Attestation endpoints.
- If the required endpoints are not allowed, Windows 11 devices with the affected compliance policies may fall out of compliance.
Message ID: MC1473600
Primary Service: Intune
Admin Impact: Medium
User Impact: Low
Release Start: 01 Mar 2027
Release End: 01 Mar 2027
Published: Sep 17, 2026
Services: Intune, Windows
Category: Plan for change
Tags: Admin Action
History
9/17/2026 Item Added to Message Center
Microsoft Message
Microsoft Intune will migrate Windows Health Attestation compliance evaluation from the current Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA). This is an Intune service-side change that will happen automatically.
Rollout schedule
We are targeting this migration at the end of Q1 in 2027.
Impact on your organization
This change affects evaluation of Windows compliance policies that rely on Health Attestation signals. Action is required to avoid interruption. Organizations that don’t allow access to the required Azure Attestation endpoints will experience issues with Health Attestation-based compliance evaluation after the migration is completed.
Action required/recommendations
Review your network, firewall, proxy, and endpoint access configurations. Specifically, verify that your environment allows devices to access the required Microsoft Azure Attestation endpoints. For detailed guidance, including the required endpoints and configuration recommendations, consult Configure endpoints for Azure Attestation migration.
Compliance considerations
If unaddressed, Windows 11 devices with assigned compliance policies using any of the device health settings (BitLocker, Secure Boot, Code Integrity) will fall out of compliance.