Skip to main content
MDM compliance answers three questions for IT and security teams:
  • Are my devices still in line with our policies? For example, is the disk encrypted, is the operating system up to date, is the antivirus running, is the device still enrolled and online?
  • Which deviations should raise an issue? You decide which device statuses count as a violation. Anything you do not flag is ignored.
  • Who works the issue? You decide which issues open a ticket, and whether Primo AI works those tickets for you.
Every time a device syncs, Primo re-evaluates it against your compliance rules and updates the issues list automatically. There is no separate scan to launch and no issue to acknowledge by hand.

​
Where compliance lives

Compliance lives in two places in the cockpit:
  • Go to Compliance > Compliance issues to see the live list of devices currently violating your policies — your daily triage queue.
  • Go to Compliance > Compliance issue settings to choose which statuses, per issue type, count as a violation.
A device only appears in the issues list if its current status matches a status you set to raise an issue, and the device is not covered by an exception. Change the settings, and the list updates on the next device sync.

​
Key concepts

  • Issue type — A category Primo audits. Enrollment Status and Online Status are global and apply to every device. Every other issue type (encryption, OS update, password policy, firewall, Wi-Fi, antivirus, admin user management, and so on) is tied to a specific MDM control, and is listed read-only until that control is deployed.
  • Status — A rule-specific value such as Encrypted, Not encrypted, Up to date, Offline 7+ days. Each issue type has its own set of possible statuses.
  • Compliance issue rule — A per-company configuration that says what each status of a given issue type does: nothing, raise an issue, or raise an issue and open a ticket.
  • Exception — A category of device that compliance skips entirely, such as unassigned devices or devices held in stock.
  • Grace period — How long a status that is still being applied has to persist before it raises an issue.
  • Compliance issue — A device that currently reports a status flagged as non-compliant by one of your rules. Issues appear in the issues list, on the device, and in your filters and counts.
  • Compliance ticket — A ticket Primo opens for a single compliance issue. One issue carries at most one ticket, so a device with five issues can carry five tickets.
  • AI Remediation — Primo AI working your compliance tickets under a written policy. Publishing the policy turns it on.

​
How issues work

1

Device syncs with Primo

Whenever a managed device checks in, Primo re-runs every compliance rule against it.
2

Primo computes a status per rule

Each rule returns a status — for example Encrypted for the encryption rule, Offline 7+ days for the online rule.
3

Primo compares the status to your rules

If the status appears in the non-compliant list you configured for that rule, the device is flagged with an issue. Otherwise it is considered compliant.
4

Issues auto-resolve

When a device’s status improves — encryption completes, the OS updates, the device comes back online — the issue clears on the next sync. There is no acknowledge or snooze action.

​
Triage the issues list

Go to Compliance > Compliance issues. The list is sorted most-recent first and updates on every device sync.
  • Filter by Device or Type, show or hide columns, and save a filtered view. The default view is All compliance issues. Sorting and grouping are not available on this table.
  • Click a row to open the device drawer. Review the device’s status across every compliance rule, jump to the related MDM control, or run a device action (push profile, lock, wipe — see Manage your devices).
  • A needs attention indicator flags devices with open issues anywhere a device is shown in the cockpit.
Issues clear on their own. There is no acknowledge, snooze, or close: an issue disappears when the device’s status changes or when you set that status back to Off in compliance issue settings.

​
From issue to ticket

Set a status to Create Issue and Ticket and Primo opens a ticket for every device reporting it.
  • The ticket carries a translated title, the Compliance tag, the device, the device’s owner as requester, and your ticket defaults.
  • Switching a status to Create Issue and Ticket backfills tickets for the devices already affected. Expect a batch on the first change.
  • You can also open a ticket by hand from a single row in the compliance issues list, even for a status you have not configured for ticketing.
  • When the device reports compliant again, the issue disappears and Primo closes the ticket by itself.
  • Ticket creation and closure are reconciled on every compliance computation. A transient outage delays a ticket by one sync cycle rather than losing it.
With AI Remediation on, every new compliance ticket is assigned to Primo AI, which diagnoses the issue, pushes the fix when there is one, and hands back what only IT can decide. Without it, compliance tickets stay with your team.

​
Platform coverage

Compliance applies to every platform Primo manages: macOS, Windows, Linux, iOS, iPadOS, and Android. Each rule only returns meaningful results on platforms where the underlying control runs. For example, FileVault encryption applies only to macOS, BitLocker only to Windows, and SentinelOne to desktop platforms.

​
Permissions

​
Next steps

Configure compliance issue settings

Choose which device statuses count as a violation, which devices are exempt, and how long Primo waits before raising an issue.

Compliance issue reference

What each compliance issue status means, why macOS and Windows devices trigger it, and how to bring them back to a compliant state.

MDM Remediation Agent

Let Primo AI work your compliance tickets under a written policy: turn it on, understand its default behavior, narrow it, and steer it from the ticket.