Compromised device

A check of server-side signs of an integrity violation. It is not an antivirus scan.

Condition and parameters

In the current build, the additional parameters below are visible in the form, but these values are not sent to the server on save. Their purposes are described based on the form hints. Do not rely on the selected values being applied until the save fix is confirmed and verified on a device.

Parameter	Purpose and values	Verification and dependencies
Root / jailbreak	The device is considered to violate the policy when signs of tampering are present.	Toggle. Not sent as a setting when saving the current form.
Debugging / tampering signs	Take debugging and suspicious signs of system modification into account.	Toggle. Not sent as a setting when saving the current form.
Unknown integrity status	Treat an unknown integrity status as a risk.	Toggle. Not sent as a setting when saving the current form.

Response and assignment

Select a response and assign the policy. Use the administrator notification first. Locking requires a separate check of the command on a test device.

How to verify

Check the assignment, the freshness of the server data, the result of the check run, and the entry in “Violations”. Verify the response in the history, and the lock on the device. Do not treat the absence of a violation with unknown or stale telemetry as confirmation of security.