Compliance policies
A compliance policy answers “does this device meet the rule?”. The Compliance column on the device list takes its result from here.
When to use thisYou want to see which devices lack a passcode, run an operating system that is too old, or have not checked in for a long time, and optionally lock or wipe a device that fails.
Settings → Apple → Compliance policies. This page is for iPhone, iPad, and Mac. Android and Windows have their own compliance pages.
Create a policy
Click New policy. Give it a name.
Add a rule. Three kinds are available:
- Minimum OS version — a minimum operating system, for example 17.0 or later.
- Passcode present — the device must have a screen passcode.
- Inactive days — the device has not checked in for more days than you enter.
If you want the system to act when a device fails, add an action: Lock device (lock the screen) or Wipe device (erase the device).
Assign the policy to the whole organization on Defaults, or to one group. A device with no enabled policy assigned shows Compliant.
Wipe device erases data on the device. Add this action only when you are sure of the rule and of who it is assigned to.
Read the Compliance column
| Label | Meaning |
|---|---|
| Compliant | No enabled rule reports a violation. |
| Non Compliant | At least one rule failed. |
| Evaluating | Waiting for the device to return the check result. |
Common questions
- If I delete the policy, how does the Compliance column change?
- With no enabled rule left, the device returns to Compliant. Deleting the policy does not restore data if a wipe action already ran.
- I want to force the user to set a new passcode, not only check for one?
- That is a device policy, the passcode type. This page only scores the device, and can lock or wipe it.