The following enforcement types are available with compliance benchmarks:
- Monitor only —
With a Monitor only enforcement type, the system monitors and documents compliance status without actively enforcing changes, allowing organizations to assess their security posture and identify gaps without impacting end-user workflows. This approach is particularly valuable during initial deployment phases or for organizations that need to establish baseline metrics before implementing stricter controls.
- Monitor and enforce —
With a Monitor only enforcement type, the system monitors and documents compliance status without actively enforcing changes, allowing organizations to assess their security posture and identify gaps without impacting end-user workflows. This approach is particularly valuable during initial deployment phases or for organizations that need to establish baseline metrics before implementing stricter controls. This enforcement capability can be integrated with device compliance with Microsoft Entra or context-aware access with Google workflows to restrict resource access for non-compliant devices. For more information, see Compliance Benchmarks and Third-Party Compliance Workflows.