UEM Foundations · Course F1Lesson 4 of 5
Policy and compliance
9 min read- Explain the policy → enforcement → compliance loop
- Name the dimensions real platforms measure compliance on
- Follow a device through its lifecycle states
Enrollment gets a device under management. Policy and compliance are what management is, day after day.
Policy: declared intent
A policy is the desired state of a device, written once and enforced continuously: which settings are fixed, which features are blocked, what security posture is mandatory, which apps exist. Real policy engines group this into areas — device restrictions, network configuration, security requirements, app management, kiosk behavior — and a mature platform exposes dozens of such areas per operating system.
Two properties make policy different from "setting up a device by hand":
- It's declarative. You state the end state; the platform drives every device there and keeps it there — including devices enrolled next year.
- It's assignable. Policies attach to groups of devices, so "the warehouse fleet" or "executive laptops" is one object to reason about, not five hundred.
Compliance: continuous measurement
Policy says what should be true; compliance is the platform continuously checking what actually is. Real platforms measure several independent dimensions — WeGuard, for instance, tracks seven:
| Dimension | The question |
|---|---|
| App compliance | Are required apps present and banned apps absent? |
| Geofence | Is the device where it's allowed to be? |
| Data usage | Is consumption inside the allowed envelope? |
| SIM | Is the expected SIM present and unchanged? |
| Password/security | Does the passcode meet the required posture? |
| Rooted/jailbroken | Has the OS integrity been broken? |
| IT policy | Are the policy's own checks passing? |
A device failing any dimension is flagged — and platforms react with anything from a dashboard warning to automated action. Compliance is what turns a management console from an inventory list into a security instrument.
The lifecycle
Between enrollment and retirement, a managed device moves through states — a real platform's vocabulary looks like: Active (checking in normally), Inactive (gone quiet past a threshold — investigate), Lost / Stolen (declared, with matching protective actions), Replaced, and finally Deleted / Unprovisioned (retired from management). Operations teams live in this view: the Inactive list is tomorrow's hardware hunt, and the Lost/Stolen flow is where remote lock and wipe earn their keep.
Policy, compliance, lifecycle — declared intent, continuous measurement, managed change. That triangle is the daily reality of running a fleet, whatever logo is on the console.