Managing device compliance checks

Devices are checked for compliance with assigned policies each time they check in with Core. In addition, Core checks all devices for compliance at regular intervals to detect out-of-compliance devices that have not checked in with Core.

Using Core, you can:

update device compliance status at any time
set the timing for device compliance checks
update the device last check-in and policy update time

Core receives information regarding device compliance status and last check-in only after devices actually check-in with Core. While you can request a device check-in using the Admin Portal, many factors can affect whether a device actually checks in, such as network connectivity, or whether a device is switched on or off.

Setting the device compliance check interval

By default, all devices are checked for policy compliance every 24 hours. You can change the time between compliance checks. The Compliance Check Interval setting applies to compliance checks by the server only. Out of compliance conditions include:

Device is out of contact for the time limit you set.
Device’s root detection logic has found an issue.
Device Admin privileges have been lost.
Device has been decrypted.
Device OS version is below the expected version.

It is best to run LDAP Sync and the compliance check at different times to avoid any potential Core performance problems.

Procedure

In the Admin Portal, go to Policies & Configs > Compliance Actions.
Click Preferences.
In Edit Compliance Preferences, select one of the timings for Compliance Check Interval (2, 4, 8, 12 or 24 hours).

NOTE:

Checking the compliance status of all devices every two or four hours may impact Core performance.

Click Save.

Updating device compliance status

You can manually request a device check-in to update device compliance status for one device, several devices, or all the devices registered to Core. Updating device compliance status enables:

administrators to update the compliance status of any device without waiting for the scheduled compliance check to run
users to return to productive work when a compliance check is resolved, rather than wait for the next scheduled compliance check
administrators to update the following information about a device:
- Last check-in, updated when the device checks in
- Policy update time

Without the ability to update device status, the device in the following example could be locked for almost 24 hours after complying with the defined security policy:

a device status is jailbreak when Monday’s daily compliance check is done (the compliance check is set for 24 hours)
the device is blocked when this status is detected, due to the defined security policy
the device is brought back into compliance two hours after Monday’s compliance check
the user cannot use the device until the Tuesday daily compliance check is run 22 hours from the time the device is back in compliance

Procedure

In the Admin Portal, go to Device & Users > Devices.
Select one or more devices to update.
Select Actions > Check Compliance.
A message is displayed, letting you know that the compliance check has begun.

The compliance status of the chosen devices may not change for one to two minutes after selecting Check Compliance.

To update device compliance information for all devices:

In the Admin Portal, go to Policies & Configs > Compliance Actions.
Click Check Compliance to display a message asking if you want to update compliance status for all devices.
Click Yes to check compliance status for all devices or click No to cancel the action.

NOTE:

The compliance status of the devices may not change for one to two minutes after selecting Check Compliance.

Compliance triggers and actions

Compliance actions, configured by the administrator, may be implemented locally on the device by Mobile@Work when certain system events have occurred that cause a compliance verification check, and only when the Enforce Compliance Actions Locally on Devices check box is selected for compliance action. Compliance verification checks also occur at the device check-in interval. Out of compliance conditions include:

Out of Contact: the device has had no communication with the Core server for greater than the time period selected which is specified in days.
Compromised: the device is suspected to be rooted or an app has been installed for rooted devices.
Device Admin lost: the device administration privileges have been revoked.
Decrypted: it has been detected that the device is no longer encrypted
OS Version: the version of the operating system on the device is below the expected version

Server compliance conditions and actions

Server compliance actions resulting from compliance conditions are listed in the table below.

Table 1. Server compliance conditions and actions

Action and OS	Out of Contact	Compromised	Device Admin lost	Decrypted	OS Version
Wipe (Android only, when enabling Android custom ROM)	Wipe the device when it has been out of contact.	Wipe the device when the device has been compromised.	The device cannot be wiped when the administrator privileges have been removed.	Wipe the device when it has been detected that the device has been decrypted.	Wipe the device when the OS version is less than expected.
Alert •Android •iOS	Send an alert when the device is out of contact. You can send alerts to device users, admins, or both users and admins, using SMS, push notifications, or email.	Send an alert when the device has been compromised. You can send alerts to device users, admins, or both users and admins, using SMS, push notifications, or email.	Send an alert when administrator privileges have been removed. You can send alerts to device users, admins, or both users and admins, using SMS, push notifications, or email.	Send an alert when it has been detected that the device as been decrypted. You can send alerts to device users, admins, or both users and admins, using SMS, push notifications, or email.	Send an alert when the OS version is less than expected. You can send alerts to device users, admins, or both users and admins, using SMS, push notifications, or email.
Remove Apps •Android •iOS Removal of apps is only possible if the MDM profile is sent by Core and is present on the device OR if the app settings have the "Remove app when device is quarantined of signed-out" check box selected.	Remove managed apps when the device is out of contact.	Remove managed apps when the device has been compromised.	Managed apps cannot be removed when administrator privileges have been removed.	Remove managed apps when the device has been decrypted.	Remove managed apps when the OS version is less than expected.
Quarantine All •Android •iOS All Android Enterprise apps and functionality are hidden, except Downloads, Google Play Store, and Mobile@Work. (Applicable only if the "Quarantine app when device is quarantined" check box is selected.)	Remove all configurations when the device is out of contact.	Remove All configurations when the device has been compromised.	Remove All configurations when administrator privileges have been removed.	Remove All configurations when the device has been decrypted.	Remove All configurations when the OS version is less than expected.
Quarantine All Except Wi-Fi •Android •iOS •macOS (For Android Enterprise apps, this is applicable only if the "Quarantine app when device is quarantined" check box is selected.)	Remove all configurations except for Wi-Fi.	Remove all configurations except for Wi-Fi when compromised.	Remove all configurations except for Wi-Fi when administrator privileges have been removed.	Remove all configurations except for Wi-Fi when the device has been decrypted.	Remove all configurations except for Wi-Fi when the OS version is less than expected.
Quarantine All Except Wi-Fi on Wi-Fi Only •Android •iOS •macOS (Applicable only if the "Quarantine app when device is quarantined" check box is selected.)	Remove all configurations except for Wi-Fi on Wi-Fi only devices.	Remove all configurations except for Wi-Fi on Wi-Fi only devices when compromised.	Remove all configurations except for Wi-Fi on Wi-Fi only devices when administrator privileges have been removed.	Remove all configurations except for Wi-Fi on Wi-Fi only devices when the device has been decrypted.	Remove all configurations except for Wi-Fi on Wi-Fi only devices when the OS version is less than expected.
Block or retire AppConnect apps •iOS "Block" means blocking access to AppConnect apps.	not applicable	Block (unauthorized) or retire (unauthorize and wipe) AppConnect apps	not applicable	not applicable	not applicable

Local compliance conditions and actions

Local compliance actions do not apply to Mobile Threat Defense functionality included with Mobile@Work clients. There are also no local compliance actions for Mobile@Work for macOS devices.

Local compliance enforcement actions resulting from compliance conditions are listed in the table below.

Table 2. Local compliance conditions and actions

Situation	OS	Action
When the device can communicate with Core to perform a Compliance Check	Alert •Android •iOS	Send an alert when the device is out of contact. Alerts are sent to device users, admins, or both users and admins, using SMS, push notifications, or email.
	Block AppConnect apps •Android •iOS	Blocks access to AppConnect apps.
	Quarantine •iOS (Applicable only if the "Quarantine app when device is quarantined" check box is selected.)	When the device is out of contact, all configurations, managed apps and iBooks content are removed. New app downloads are disallowed.
	Quarantine •Android (Applicable only if the "Quarantine app when device is quarantined" check box is selected.)	When the device is out of contact, all configurations and managed apps are removed. New app downloads are disallowed.
	Quarantine •Android Enterprise	All Android Enterprise apps and functionality are hidden, except Downloads, Google Play Store, and Mobile@Work.
When the device can NOT communicate with Core to perform a Compliance check	Alert •Android •iOS	Send an alert when the device is out of contact. Alerts are sent to device users, admins, or both users and admins, using SMS, push notifications, or email.
	Block AppConnect apps •Android •iOS	Blocks access to AppConnect apps.
	Quarantine •iOS (Applicable only if the "Quarantine app when device is quarantined" check box is selected.)	When the device is out of contact, all configurations, managed apps and iBooks content are removed. New app downloads are disallowed. Quarantine action requires all appConnect apps to be re-installed after the device is back in compliance.
	Quarantine •Android (Applicable only if the "Quarantine app when device is quarantined" check box is selected.)	When the device is out of contact, all configurations and managed apps are removed. New app downloads are disallowed.
	Quarantine •Android Enterprise	All Android Enterprise apps and functionality are hidden, except Downloads, Google settings, Google Play Store, and Mobile@Work.
	Retire •Android Enterprise	The work profile is deleted or the managed device will be factory reset. This action is not reversible.