Skip to main content
Compliance issue settings tell Primo which device statuses count as a violation. Until you configure them, the issues list stays empty — Primo collects status data but does not flag anything.

​
Open compliance issue settings

Go to Compliance > Compliance issue settings. The page lists every issue type as its own section, with every status that issue type can report.

​
Two kinds of issue types

  • Global issue types — Enrollment Status and Online Status. These apply to every managed device and don’t depend on any MDM control being configured. They’re always available to configure.
  • MDM control issue types — every other one (encryption, OS update, password policy, firewall, Wi-Fi, antivirus, admin user management, and so on). These only become configurable once the matching MDM control exists.
Issue types whose MDM control isn’t set up yet are grouped separately at the top of the page, with a link to the MDM controls page. Configure the control there and the issue type moves into the main list.

​
Set what each status does

Each status is set to one of these behaviours.
1

Find the issue type

Scroll to the issue type you want to configure (for example, Enrollment Status, Online Status, Recovery OS, Encryption).
2

Set each status

For example, on Online Status, many teams set Offline 7+ days to Create Issue and leave Offline on Off, because short check-in gaps are normal.
3

Changes save automatically

From the next device sync onward, any device reporting a flagged status appears on the Compliance issues page.
An issue type with every status set to Off is effectively disabled — Primo records the statuses but never raises anything.

​
Reduce issue noise

If the issues list is too noisy, return to the settings page and set the transient or expected statuses back to Off. Common adjustments:
  • Online Status — Offline: short check-in gaps are normal. Many teams issue only on Offline 7+ days.
  • Encryption — Missing recovery key: escrow takes up to 24 hours and a restart after encryption turns on, so freshly encrypted devices trigger it transiently before it self-resolves.
  • OS Update — Grace period: a Windows device that’s late on an update but still inside its grace window. Leave off if you don’t want admins to act until the grace period ends.
After you change a status, the next device sync recomputes the issues list and devices in those statuses drop off automatically.

​
Issue types waiting on an MDM control

Issue types tied to MDM controls become configurable as soon as the underlying control is set up. Examples: Use the link at the top of the settings page to jump straight to the MDM controls list.

​
Permissions

​
Next steps