Overview
Compliance answers two questions:
- Are my devices still in line with our policies? Is the disk encrypted, is the operating system current, is the antivirus running, is the device still enrolled and online?
- Which deviations should I hear about? You choose. Anything you do not flag is ignored.
Every time a device syncs, it is re-evaluated against your rules and the alert list updates. There is no scan to launch and no alert to acknowledge by hand.
The four terms worth knowing
Term |
What it means |
|---|---|
Rule type |
A category that gets audited. Enrolment Status and Online Status are global and apply to every device. Every other type — encryption, OS update, password policy, firewall, Wi-Fi, antivirus, admin users — is tied to an MDM control and only becomes configurable once that control exists. |
Status |
A rule-specific value such as Encrypted, Not encrypted, Up to date, Offline 7+ days. Each rule type has its own set. |
Alert rule |
Your configuration: which statuses, for a given rule type, should raise an alert. |
Alert |
A device currently reporting a status you flagged as non-compliant. |
How to use
Compliance lives on one page:
- Go to MDM > Compliance Alerts to see the live list of devices currently violating your policies. This is your daily triage queue.
- Click Manage rules, top right, to choose which statuses count as a violation.
A device only appears in the alerts list if its current status matches one you flagged in Manage rules. Change the rules and the list updates on the next device sync.
How an alert appears and clears
- The device syncs. Every compliance rule is re-run against it.
- A status is computed per rule — Encrypted for the encryption rule, Offline 7+ days for the online rule, and so on.
- The status is compared to your rules. If it appears in the non-compliant list you configured, the device is flagged. Otherwise it counts as compliant.
- The alert clears on its own when the status improves: encryption completes, the operating system updates, the device comes back online. There is no acknowledge or snooze.
Platform coverage
Compliance runs on every platform managed: macOS, Windows, Linux, iOS, iPadOS and Android. Each rule only returns meaningful results where the underlying control runs — FileVault encryption on macOS, BitLocker on Windows, SentinelOne on desktop platforms.
Permissions
Action |
Permission |
|---|---|
View alerts and rules |
MDM_READ |
Edit alert rules |
MDM_WRITE |
Tips and Best Practices
- Configure the rules before you judge the feature. Until you flag statuses, the alert list stays empty — status data is collected but nothing is raised.
- Start with the two global rules. Enrolment Status and Online Status work on every device without any MDM control in place, so they give you a useful list on day one.
- Do not flag every status you can. An alert list nobody triages is worse than no list. Flag what you would actually act on.
- Expect a noisy first week. Freshly encrypted devices and recently offline machines both resolve themselves; tune the rules once you have seen a normal week.
Troubleshooting and FAQ
Troubleshooting
The alerts list is empty even though devices are clearly non-compliant. No statuses have been flagged yet. Status data is collected regardless, but nothing appears until you configure rules in Manage rules.
A rule I want is not configurable. It is tied to an MDM control that does not exist yet. Rules for encryption, firewall, antivirus and the rest only appear once the matching control is set up.
An alert did not clear after we fixed the device. Alerts recompute on device sync, not immediately. Wait for the next check-in.
FAQ
-
Do we have to acknowledge or close alerts?
No. They clear automatically when the device's status improves.
-
Is there a scan to schedule?
No. Re-evaluation happens on every device sync.
-
Why do some rules apply to every device and others do not?
Enrolment Status and Online Status are global. Everything else depends on an MDM control existing first