After establishing baseline measurements through a Monitor only implementation, you can change a benchmark to use the Monitor and enforce enforcement type to actively maintain compliance standards. When a benchmark is configured for enforcement, the necessary management settings are automatically generated and deployed to bring devices into compliance with the selected security standards.
With the Monitor and enforce enforcement type, the system continuously monitors device configurations and automatically remediates any deviations from the established benchmark settings. When a device falls out of compliance, the system automatically applies the required configuration profiles or executes remediation scripts to restore the device to a compliant state.
Jamf recommends implementing enforcement gradually by using smart computer groups to phase the rollout of a Monitor and enforce implementation. This approach allows you to validate the impact of enforcement actions on a subset of computers before expanding to the broader fleet.