How to create a compliance policy for devices?

Configuring compliance policies before enrolling devices lays a strong security foundation. If a device fails to meet the configured compliance criteria during its Mobile Device Management (MDM) lifecycle, it becomes non-compliant. Admins can effectively identify and address compliance violations from the device details page.

Compliance policies in Hexnode UEM allow administrators to define a set of rules and regulations that ensure devices comply with organizational requirements. These policies can be configured for multiple platforms, such as iOS, iPadOS, Windows, macOS, Android, visionOS, Linux, and ChromeOS.

Hexnode offers both basic and advanced compliance configuration settings. Basic settings allow administrators to select from a predefined set of compliance requirements, enabling quick detection of common device vulnerabilities. Advanced settings, on the other hand, offer granular control, allowing administrators to define custom compliance rules using a wide range of device attributes. It enables the creation of compliance policies tailored to each device platform.

This document will guide you through the process of creating and assigning compliance policies in Hexnode UEM.

Creating a Compliance policy in Hexnode

To create a compliance policy in Hexnode UEM:

1. Log in to your Hexnode UEM console.
2. Navigate to Policies > Compliance Policies.
3. Choose an existing policy or click New Policy to create a new one.
4. Enter the basic details for the policy:
   1. Policy Name: A name to identify the policy being configured. This is a mandatory field.
   2. Description: A brief description of the policy. This is optional, with a maximum character limit of 500.
5. You will then be presented with two types of settings:
   1. Basic Settings: Admins are provided with a set of predefined compliance settings to choose from.
   2. Advanced Settings: These provide a wider range of configurable factors to define compliance criteria, also curated based on the selected platform.

Advanced Settings

The Advanced settings provide administrators with granular controls over device compliance evaluation curated by various device attributes. The following table lists all the available device attributes along with their description.

By configuring a combination of criteria, comparator, and appropriate values, admins can configure precise rules that mark devices as non-compliant upon meeting the criteria.

Multiple criteria can be added to a policy using the Add Criteria option. When multiple conditions are involved, administrators can use logical operators ‘AND’ and ‘OR’, to define how the system evaluates the rules. These operators appear to the left of every additional condition following the initial one:

• AND ensures that a device must meet all specified conditions to be considered non-compliant.
• OR allows a device to be marked non-compliant if it satisfies any one of the specified conditions.

The following tables list the supported criteria available for each platform, along with their respective comparators and values. Where applicable, fields may require manual input by the administrator if predefined options are not available.

Android

iOS

Windows

macOS

Apple TV

Linux

visionOS

ChromeOS

Associating compliance policies with devices

Associating the compliance configurations with the targets:

• When the policy is not yet saved,
  1. Go to Policy Targets within the Policies tab.
  2. Click on Users > + Add Users, select the required users and click OK to associate the policy with the target users. As a result, when a device is enrolled to a targeted user, the compliance policies will be automatically applied to that user’s devices.
  3. You can also associate the policy with Devices, Device Groups, User Groups, or Domains from the left pane of the Policy Targets tab.
• When the policy has already been saved,
  1. From the Policies > Compliance Policies, select the appropriate policy
  2. Then click on Manage > Associate Targets > choose the target users and click on Associate to associate the policy with the target users. Enroll a device to a targeted user to automatically apply the associated compliance policies.
  3. You can also associate the policy with Devices, Device Groups, User Groups, or Domains.

Policy Summary

The Policy Summary includes the version of the policy, created date, modified date, target count, and configured settings. To view the Policy Summary:

1. Navigate to Policies > Compliance Policies.
2. Click on the policy summary icon on the right side of the policy.
3. You can view the policy summary here.
4. Click Manage at the top right corner to modify or clone the policy.