Using the console
Compliance
How a device is judged against its policy, and what happens when it falls out of line.
A device is compliant when it follows every setting in its policy. When something doesn't match, the device has a finding, and its badge changes.
| Badge | Meaning |
|---|---|
| Compliant | Nothing out of line. |
| Grace period | Something is out of line, but the policy's grace period hasn't run out. Nothing else happens yet. |
| Non-compliant | Out of line, and the grace period, if any, is over. |
Where findings come from
- Settings a device can't be forced to follow. Encryption, for example, can only be checked: a device whose storage isn't encrypted is reported, not fixed.
- Settings the device failed to apply, such as a screen lock the person hasn't set yet.
- The policy's compliance rules, below.
- Places devices belong: a device outside them at the times they apply. See Locations.
Each finding has a short code such as PASSWORD_WEAK or OS_OUTDATED and a plain description, shown on
the device's page and on Alerts.
Compliance rules
Under Compliance in the policy editor:
| Setting | What it does |
|---|---|
| Minimum Android version | Android devices on an older version are non-compliant. |
| Maximum security patch age | Android devices whose security patch is older than this are non-compliant. Manufacturers stop patching old models, so set it with your oldest devices in mind. |
| Block rooted or tampered devices | Devices that look rooted, run an unofficial build, or fail Google's integrity checks are non-compliant. Google checks devices it manages; agent devices are checked with Google Play Integrity from agent 1.8.0. |
| Minimum Windows version | Windows devices on an older release are non-compliant. |
| Mark devices offline for longer than | Devices that haven't checked in for this many days are non-compliant until they next check in. |
| Grace period | How long a device can be out of line before it counts as non-compliant. Until then it shows Grace period and nothing else happens. |
| When a device becomes non-compliant | Do nothing or Lock the screen. Runs once, when the grace period ends. Devices that are only offline aren't locked, because they would lock the moment they came back. |
| Email admins | Admins get an email listing devices that have just become non-compliant, at most every few minutes. |
Getting a device back in line
A device clears its own findings when it next checks in in line with its policy. There is nothing to dismiss by hand. To speed it up, fix the cause and select Sync now on the device.
The Fix a non-compliant device runbook covers who fixes what.