Skip to main content

Apple policy: Compliance rules

Apple

policy:The Compliance rules section of the Apple Policy Editor sets requirements for the devices of the policy. A device that breaks a rule is non-compliant at once: the device page shows why, in Why the device is non-compliant, and the devices list shows it as non-compliant. A device is also non-compliant when a setting of the policy can't be applied on it.

Rules

  • Passcode: the device has a passcode, and it meets the passcode settings of the policy.
  • Minimum OS version: for iPhone and iPad, or for Mac. To update the devices, add a required update in Software updates.
  • Supervised device: devices enrolled with the enrollment profile or with User Enrollment aren't supervised.
  • FileVault on (Mac): the disk of the Mac is encrypted with FileVault. Other devices aren't affected.

Content loading.A rule is checked when the device sends its status, when the policy is saved, and every hour. A device whose status is unknown (for example a Mac that didn't report FileVault yet) doesn't break the rule.

Blocking the device

 Turn on Block the device if it's still non-compliant and set after how many days (0 blocks at once).. Supervised iPhone and iPad go into lost mode with the message you set. The other devices are locked once; a Mac restarts and asks for a PIN, shown in the details of the command in the command history.

  • Unblock: when the device is compliant again, lost mode is turned off automatically.
  • Turning lost mode off yourself: the device isn't blocked again until it becomes compliant and breaks a rule again. Use it to let the user fix the device.

 To be notified, or to react in other ways, create an event rule for Device becomes non-compliant: it also gets the reasons.