Compliance Policies Scope

[pkffischer]

According to the naming convention, I set the Windows Compliance Policies to “All Users.” Is this correct?
For us, this means that if a user does not log in to the device correctly (e.g., clicks away MFA), the compliance status is not transferred.
If I set the compliance policies to “All Devices,” the compliance status of the device is read correctly. Hence my question: Why are compliance policies assigned to users and not devices in OIB?