Forum Discussion

StuartK73's avatar
StuartK73
Iron Contributor
Sep 20, 2018

Device Config Policy vs Device Compliance Policy

Hi All   Some clarification required on when to use Config Policy vs Compliance Policy or both.   Is there any point in creating a device config policy when a similar compliance policy is set to ...
  • Oliver Kieselbach's avatar
    Sep 21, 2018

    Hi Stuart,

    compliance settings are mostly used in combination with conditional access to check a device for certain settings and then set a compliant flag or not. It can also be used just for reporting if certain settings are set like BitLocker. So it's a kind of simple check and remember if several compliance policies have the same setting, they are evaluated and the most restrictive value counts. Pin 4 and Pin 6 in two compliance policies, then pin length 6 is enforced.

    Configuration policies instead are the way to configure and not to check. E.g. set creation of something like passwords to deny simple passwords. Its not a check, it will enforce the setting in the password example during creation of the password. If two configuration policies have same setting they are in conflict and the setting will not be applied.

     

    Hope this helps in you decisions.

    best,

    Oliver

Resources