> ## Documentation Index
> Fetch the complete documentation index at: https://docs.getprimo.com/llms.txt
> Use this file to discover all available pages before exploring further.

# MDM compliance overview

> Continuously audit every managed device against your security and IT policies, surface deviations, decide which device states count as a violation, and route them to tickets.

MDM compliance answers three questions for IT and security teams:

* **Are my devices still in line with our policies?** For example, is the disk encrypted, is the operating system up to date, is the antivirus running, is the device still enrolled and online?
* **Which deviations should raise an issue?** You decide which device statuses count as a violation. Anything you do not flag is ignored.
* **Who works the issue?** You decide which issues open a ticket, and whether Primo AI works those tickets for you.

Every time a device syncs, Primo re-evaluates it against your compliance rules and updates the issues list automatically. There is no separate scan to launch and no issue to acknowledge by hand.

## Where compliance lives

Compliance lives in two places in the cockpit:

* Go to **Compliance > Compliance issues** to see the live list of devices currently violating your policies — your daily triage queue.
* Go to **Compliance > Compliance issue settings** to choose which statuses, per issue type, count as a violation.

A device only appears in the issues list if its current status matches a status you set to raise an issue, and the device is not covered by an exception. Change the settings, and the list updates on the next device sync.

## Key concepts

* **Issue type** — A category Primo audits. **Enrollment Status** and **Online Status** are global and apply to every device. Every other issue type (encryption, OS update, password policy, firewall, Wi-Fi, antivirus, admin user management, and so on) is tied to a specific MDM control, and is listed read-only until that control is deployed.
* **Status** — A rule-specific value such as **Encrypted**, **Not encrypted**, **Up to date**, **Offline 7+ days**. Each issue type has its own set of possible statuses.
* **Compliance issue rule** — A per-company configuration that says what each status of a given issue type does: nothing, raise an issue, or raise an issue and open a ticket.
* **Exception** — A category of device that compliance skips entirely, such as unassigned devices or devices held in stock.
* **Grace period** — How long a status that is still being applied has to persist before it raises an issue.
* **Compliance issue** — A device that currently reports a status flagged as non-compliant by one of your rules. Issues appear in the issues list, on the device, and in your filters and counts.
* **Compliance ticket** — A ticket Primo opens for a single compliance issue. One issue carries at most one ticket, so a device with five issues can carry five tickets.
* **AI Remediation** — Primo AI working your compliance tickets under a written policy. Publishing the policy turns it on.

## How issues work

<Steps>
  <Step title="Device syncs with Primo">
    Whenever a managed device checks in, Primo re-runs every compliance rule against it.
  </Step>

  <Step title="Primo computes a status per rule">
    Each rule returns a status — for example **Encrypted** for the encryption rule, **Offline 7+ days** for the online rule.
  </Step>

  <Step title="Primo compares the status to your rules">
    If the status appears in the non-compliant list you configured for that rule, the device is flagged with an issue. Otherwise it is considered compliant.
  </Step>

  <Step title="Issues auto-resolve">
    When a device's status improves — encryption completes, the OS updates, the device comes back online — the issue clears on the next sync. There is no acknowledge or snooze action.
  </Step>
</Steps>

## Triage the issues list

Go to **Compliance > Compliance issues**. The list is sorted most-recent first and updates on every device sync.

| Column | What it shows |
| - | - |
| **Status** | The non-compliant status reported by the device (for example `NOT_ENCRYPTED`, `OFFLINE_7_DAYS`). |
| **Control name** | The MDM control or compliance rule that raised the issue. |
| **Type** | The rule category (encryption, OS update, antivirus, and so on). |
| **Device name** | The affected device. |
| **Date** | When Primo last evaluated the issue. |

* Filter by **Device** or **Type**, show or hide columns, and save a filtered view. The default view is **All compliance issues**. Sorting and grouping are not available on this table.
* Click a row to open the device drawer. Review the device's status across every compliance rule, jump to the related MDM control, or run a device action (push profile, lock, wipe — see [Manage your devices](/mdm/guides/wiping-devices)).
* A **needs attention** indicator flags devices with open issues anywhere a device is shown in the cockpit.

Issues clear on their own. There is no acknowledge, snooze, or close: an issue disappears when the device's status changes or when you set that status back to **Off** in [compliance issue settings](/mdm/compliance/issue-settings).

## From issue to ticket

Set a status to **Create Issue and Ticket** and Primo opens a ticket for every device reporting it.

* The ticket carries a translated title, the **Compliance** tag, the device, the device's owner as requester, and your [ticket defaults](/mdm/compliance/issue-settings#set-compliance-ticket-defaults).
* Switching a status to **Create Issue and Ticket** backfills tickets for the devices already affected. Expect a batch on the first change.
* You can also open a ticket by hand from a single row in the compliance issues list, even for a status you have not configured for ticketing.
* When the device reports compliant again, the issue disappears and Primo closes the ticket by itself.
* Ticket creation and closure are reconciled on every compliance computation. A transient outage delays a ticket by one sync cycle rather than losing it.

With [AI Remediation](/mdm/compliance/ai-remediation) on, every new compliance ticket is assigned to Primo AI, which diagnoses the issue, pushes the fix when there is one, and hands back what only IT can decide. Without it, compliance tickets stay with your team.

## Platform coverage

Compliance applies to every platform Primo manages: macOS, Windows, Linux, iOS, iPadOS, and Android. Each rule only returns meaningful results on platforms where the underlying control runs. For example, FileVault encryption applies only to macOS, BitLocker only to Windows, and SentinelOne to desktop platforms.

## Permissions

| Action | Permission |
| - | - |
| View issues, settings, and the AI Remediation policy | `MDM_READ` |
| Edit issue settings, ticket defaults, and the AI Remediation policy | `MDM_WRITE` |

## Next steps

<CardGroup cols={2}>
  <Card title="Configure compliance issue settings" icon="sliders" href="/mdm/compliance/issue-settings">
    Choose which device statuses count as a violation, which devices are exempt, and how long Primo waits before raising an issue.
  </Card>

  <Card title="Compliance issue reference" icon="book-open" href="/mdm/compliance/issue-reference">
    What each compliance issue status means, why macOS and Windows devices trigger it, and how to bring them back to a compliant state.
  </Card>

  <Card title="MDM Remediation Agent" icon="robot" href="/mdm/compliance/ai-remediation">
    Let Primo AI work your compliance tickets under a written policy: turn it on, understand its default behavior, narrow it, and steer it from the ticket.
  </Card>
</CardGroup>


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.