> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Configure compliance issue settings

> Choose which device statuses count as a violation so the issues list reflects your organization's risk posture.

Compliance issue settings tell Primo which device statuses count as a violation. Until you configure them, the issues list stays empty — Primo collects status data but does not flag anything.

## Open compliance issue settings

Go to **Compliance > Compliance issue settings**.

The page lists every issue type as its own section, with every status that issue type can report.

## Two kinds of issue types

* **Global issue types** — **Enrollment Status** and **Online Status**. These apply to every managed device and don't depend on any MDM control being configured. They're always available to configure.
* **MDM control issue types** — every other one (encryption, OS update, password policy, firewall, Wi-Fi, antivirus, admin user management, and so on). These only become configurable once the matching MDM control exists.

Issue types whose MDM control isn't set up yet are grouped separately at the top of the page, with a link to the MDM controls page. Configure the control there and the issue type moves into the main list.

## Set what each status does

Each status is set to one of these behaviours.

| Behaviour                   | What happens                                                                                                |
| --------------------------- | ----------------------------------------------------------------------------------------------------------- |
| **Off**                     | The status is still reported on the device, but it raises nothing.                                          |
| **Create Issue**            | Raises a compliance issue, visible in the issues list, on the device, and in your filters and counts.       |
| **Create Issue and Ticket** | Raises the issue and opens a ticket for it. Available with [auto remediation](/mdm/compliance/remediation). |

<Steps>
  <Step title="Find the issue type">
    Scroll to the issue type you want to configure (for example, Enrollment Status, Online Status, Recovery OS, Encryption).
  </Step>

  <Step title="Set each status">
    For example, on **Online Status**, many teams set **Offline 7+ days** to **Create Issue** and leave **Offline** on **Off**, because short check-in gaps are normal.
  </Step>

  <Step title="Changes save automatically">
    From the next device sync onward, any device reporting a flagged status appears on the **Compliance issues** page.
  </Step>
</Steps>

An issue type with every status set to **Off** is effectively disabled — Primo records the statuses but never raises anything.

## Reduce issue noise

If the issues list is too noisy, return to the settings page and set the transient or expected statuses back to **Off**. Common adjustments:

* **Online Status — Offline**: short check-in gaps are normal. Many teams issue only on **Offline 7+ days**.
* **Encryption — Missing recovery key**: escrow takes up to 24 hours and a restart after encryption turns on, so freshly encrypted devices trigger it transiently before it self-resolves.
* **OS Update — Grace period**: a Windows device that's late on an update but still inside its grace window. Leave off if you don't want admins to act until the grace period ends.

After you change a status, the next device sync recomputes the issues list and devices in those statuses drop off automatically.

## Issue types waiting on an MDM control

Issue types tied to MDM controls become configurable as soon as the underlying control is set up. Examples:

| Issue type                                                                      | Becomes available when                            |
| ------------------------------------------------------------------------------- | ------------------------------------------------- |
| ThreatDown / SentinelOne                                                        | The endpoint protection integration is connected  |
| USB Blocking, App Blocking, Disable AirDrop, Screen Capture, Lock Profiles Pane | The matching MDM control exists                   |
| Admin Password Rotation                                                         | The admin password rotation control is configured |
| Entra SSO, Okta SSO                                                             | The corresponding identity control is configured  |

Use the link at the top of the settings page to jump straight to the MDM controls list.

## Permissions

| Action          | Permission  |
| --------------- | ----------- |
| View settings   | `MDM_READ`  |
| Change settings | `MDM_WRITE` |

## Next steps

* [Monitor compliance issues](/mdm/compliance/issues) — work through the list of devices currently in violation.
* [Compliance issue reference](/mdm/compliance/issue-reference) — what each status means before you decide whether it should raise an issue.
* [Compliance issue auto remediation](/mdm/compliance/remediation) — open a ticket for an issue and let Primo AI work it.