Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 6 replies
  • Subscribers 5 subscribers
  • Views 17747 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Compliance checks - Does anyone actually know how it works?

Neil_Evolve

I'm puzzled.

Could someone please explain how compliance checks are carried out on iOS devices and whether the SMC app is a requirement?

For instance, I have configured a basic compliance rule stating devices must have a passcode, but removing the passcode from devices does not create a non-compliance situation no matter how long I wait.

Does the SMC app have to be installed for all aspects of compliance checks to work or only for certain features? If so is there any way to enforce the installation other than on "supervised" devices, after all we can't configure BYOD objects as "supervised".

Hopefully someone knows or is everyone as confused as I am.

Come on Sophos, the documentation and information around this is pretty poor.

:54397


This thread was automatically locked due to age.
Parents
  • 0

    Hello,

    the compliance check is done on the server, not on the client.

    The server checks the information it has after it gets new information from the device as well as on a regular basis. 

    If a device is non compliant it flags it as such and sends a message to the device informing about the non compliance. 

    The information needed for the compliance check is transmitted without the app (Except for location tracing information which is done by the app). Therefore the MDM Profile is needed which is installed during device roll out.

    The messages sent to the device informing about non comliance require the app to be running in the background since the app displays the messages.

    Regarding the passcode compliance check: This is a setting that does not get synced to the server immedeatly due to Apples design. However, you could simply enforce a passcode using a policy.

    If the other settings for the compliance set also take that long, please open a ticket with support so we can analyse better and help you get it resolved.

    Regards
    Thomas

    :54489
Reply
  • 0

    Hello,

    the compliance check is done on the server, not on the client.

    The server checks the information it has after it gets new information from the device as well as on a regular basis. 

    If a device is non compliant it flags it as such and sends a message to the device informing about the non compliance. 

    The information needed for the compliance check is transmitted without the app (Except for location tracing information which is done by the app). Therefore the MDM Profile is needed which is installed during device roll out.

    The messages sent to the device informing about non comliance require the app to be running in the background since the app displays the messages.

    Regarding the passcode compliance check: This is a setting that does not get synced to the server immedeatly due to Apples design. However, you could simply enforce a passcode using a policy.

    If the other settings for the compliance set also take that long, please open a ticket with support so we can analyse better and help you get it resolved.

    Regards
    Thomas

    :54489
Children
No Data
Unfiltered HTML