What do Due, Overdue and Offline unusual mean on a device?
They describe how long a device has gone without syncing. Due means it is a little late, Overdue means it is later still, and Offline unusual means the silence is longer than normal for that device. Past the final limit it becomes a breach. All thresholds are editable, so you can match them to your own routines.
Think of these as steps on a ladder, each one giving a clearer signal that a device needs attention. They are based on the time since the device last synced, so they depend on the sync interval you have set.
Due: the device has passed the point where it should have synced. On a device that is Due, an overlay shown on unlock syncs first and only gates the device if the sync does not finish. A student on a school tablet will usually just see a short wait. Overdue: it has gone longer, and the dashboard marks it so. Offline unusual: the device has been quiet for longer than you would expect for an ordinary absence of network.
Offline mode is a separate idea. A device can be put into offline mode with its own allowed apps and an organisation maximum, and it leaves that mode automatically when the network returns. So a tablet on a school trip without data is not in trouble, it is following a rule.
Beyond these states is the breach limit, described in what counts as a breach. Due, Overdue, Offline unusual and breach are all thresholds you can edit, along with the sync interval. Shorter limits find problems sooner but raise more alerts. Longer limits are calmer but slower.
Practical tip: set the limits so that a normal weekend does not push every device into Overdue. Look at last-seen times on a normal Monday morning, and adjust until the list shows only real exceptions.