Intune: Windows Health Attestation compliance moves to Microsoft Azure Attestation (H1 2027)
Summary
Microsoft plans to automatically migrate Windows Health Attestation compliance evaluation in Intune from the Device Health Attestation (DHA) service to Microsoft Azure Attestation (MAA) in the first half of 2027. It affects Windows 11 devices managed with Intune. Network, firewall, proxy and endpoint access must allow the new endpoints to avoid interruptions. No exact date has been announced.
What changes?
The evaluation of Windows Health Attestation compliance policies switches automatically to MAA. If devices cannot reach the required endpoints, compliance evaluation may be interrupted. The source does not describe specific error messages.
Affected
- Windows 11 devices managed via Microsoft Intune
- Compliance policies using Windows Health Attestation (Device Health Attestation)
- Organisations with restrictive network, firewall, proxy or endpoint access configurations
Preparation and temporary exceptions
- Review your network, firewall, proxy and endpoint access configuration.
- Follow the instructions in Microsoft's article "Configure endpoints for Azure Attestation migration" (Intune network endpoints documentation) and allow the listed endpoints.
Check and complete
Not a defect. The migration is planned for the first half of 2027; verify endpoint access beforehand using the Microsoft documentation.
Recommendation
Check the Microsoft endpoint list now and update firewall and proxy rules for MAA before the migration. Identify which compliance policies use Windows Health Attestation, and watch the Windows message center for the exact date.
Timeline
- Microsoft announces the migration in the Windows message center.
- Planned for the first half of 2027: automatic migration from Device Health Attestation (DHA) to Microsoft Azure Attestation (MAA). No exact date given.
Sources
- Intune: Configure endpoints for Azure Attestation migration Vendor · learn.microsoft.com
Compiled from the sources listed and translated with AI (Claude); status and dates come from the vendor. The vendor’s statements are authoritative. Updated 1 Nov 2026, 15:56.
Where the information comes from
We continuously read the vendors’ official sources, community reports and trade media and summarise them in our own words, with a link to the source:
- Microsoft: Windows release health (Windows 10/11, Server 2016 to 2025), Windows message center, known issues of Microsoft 365 Apps (Outlook, Excel, Word, PowerPoint), Edge, Intune, Autopilot, Windows 365 and Entra Connect, Microsoft KB articles with timelines, Exchange and Windows IT Pro blogs, optionally Microsoft 365 service health and message center
- other vendors: Veeam KB, Citrix (known issues), Ubuntu and Debian (regressions), Broadcom (VMware), Fortinet, Cisco, Mozilla, Let’s Encrypt
- community (title, short excerpt and link only, without the names of the authors): Microsoft Q&A, Microsoft Tech Community (discussions), Veeam R&D Forums, Eleven Forum
- targeted web research with AI (Claude), e.g. on the updates of the month – this also finds discussions on Reddit and in forums; such entries are labelled as community reports until the vendor confirms them
- early warning from trade media (title and link only): Born’s Tech and Windows World, BleepingComputer, AskWoody, Windows Latest, Windows Central, gHacks, The Windows Club, Deskmodder, Dr. Windows, WindowsArea, Frankys Web, heise online
Summary and translation with AI (Claude by Anthropic) – without any data of visitors.
Affected? We can help.
We check whether your systems are affected, apply workarounds properly and plan for dated changes in good time.