Declarative Device Management policy from Intune failing on 18% of iOS devices. We've had the policy deployed since April 2025. Found that there were 18% of the devices non-compliant on this policy, though all their devices are marked compliant. We don't utilize the Automated Device Enrollment program, none of our devices are Supervised. Among the devices I found my iPhone as non-compliant. My iPad is compliant. They are both running on the latest iOS 27.0.
I created a new policy, same settings, but only targeted my account. The policy pushed out and still failed on my iPhone and was successful on my iPad.
Not sure how the DDM configurations work, I'm assuming that they either confirm user settings meet the configuration, or that they enforce the settings onto the device. To test this, I added an additional DDM setting to the test policy. I configured the policy in regards to the Safari browser, when opening a new tab, it should open to CNN homepage. I pushed the policy, and found these settings were compliant on BOTH devices. I tested the browser on both, and neither opened a new tab to CNN.
Also back to the Enforce Latest Software Update Version settings. Both of my devices are set to conduct Automatic updates. Nowhere in the Settings am I finding a place to configure the Install Time and Delay in Days for the iOS update. So I don't think the DDM policy is comparing desired settings to settings configured on the device.
So I'm unsure how these DDM policies work. What would be the reason that the device would be non-compliant to the Enforce Latest Software Update Version set of configurations.
I did find this other thread from earlier this year
DDM updates fail on iPads in Intune - Apple Community
The thread is closed, and it was left a mystery as to what resolved, or if the issue was actually resolved.
Do tags to specific users work? @Bebrillet