Skip to main content
A compliance alert rule tells Primo: “For this rule type, these statuses should trigger an alert.” Until you configure rules, the alerts list stays empty — Primo collects status data but does not flag anything.

​
Open the rules panel

  1. Go to MDM > Compliance Alerts.
  2. Click Manage rules in the top-right of the page.
The page lists every rule type as its own section, with one toggle per possible status.

​
Two kinds of rules

  • Global rules — Enrollment Status and Online Status. These apply to every managed device and don’t depend on any MDM control being configured. They’re always available to configure.
  • MDM control rules — every other rule type (encryption, OS update, password policy, firewall, Wi-Fi, antivirus, admin user management, and so on). These only become configurable once the matching MDM control exists.
If a rule’s underlying MDM control isn’t set up yet, the rule appears at the top of the page in a banner labelled “X compliance alerts can’t be set up yet”, with a chip for each affected rule and a Manage MDM controls button that takes you to the MDM controls page. Configure the control there and the rule moves into the main list.

​
Configure a rule

1

Find the rule

Scroll to the rule type you want to configure (for example, Enrollment Status, Online Status, Recovery OS, Encryption).
2

Toggle the statuses that should trigger an alert

Each rule lists every possible status the device can report. Turn on the toggle next to each status you want to treat as a violation, and leave the rest off.For example, on Online Status, many teams turn on Offline 7+ days but leave Offline off, because short check-in gaps are normal.
3

Changes save automatically

From the next device sync onward, any device reporting a flagged status appears on the Compliance Alerts page.
A rule with no statuses toggled on is effectively off — Primo records the status but never raises an alert.

​
Reduce alert noise

If the alerts list is too noisy, return to Manage rules and turn off statuses that are too transient or expected. Common adjustments:
  • Online Status — Offline: short check-in gaps are normal. Many teams alert only on Offline 7+ days.
  • Encryption — Pending escrow: the device is encrypting and uploading the recovery key. Often safe to leave off.
  • OS Update — Grace period: a Windows device that’s late on an update but still inside its grace window. Leave off if you don’t want admins to act until the grace period ends.
After you change a toggle, the next device sync recomputes the alert list and devices in those statuses drop off automatically.

​
Rules waiting on an MDM control

Rules tied to MDM controls become configurable as soon as the underlying control is set up. Examples: Click Manage MDM controls in the banner at the top of the rules page to jump straight to the MDM controls list.

​
Permissions

​
Next steps