Monitoring for Non-Compliant Computers

When a computer falls out of the scope of the smart computer group used to monitor compliance, it is no longer marked as compliant in Entra ID. Non-compliant computers are unable to access company resources until they are brought back into compliance.

You can use a combination of smart computer groups, computer apps, and configuration profiles in Jamf Pro to monitor non-compliant computers. The best method to monitor non-compliant devices depends on your environment. For assistance, contact Jamf Support.

Follow these steps to set up monitoring for non-compliant devices and send email notifications to users with non-compliant devices:

In Jamf Pro, create a new smart computer group for the compliance criteria you want to monitor.
Example:
You may want to create smart groups for computers that do not have FileVault installed or computers without the current macOS version. You can also leverage a smart computer group created via compliance benchmarks. For more information, see the Compliance Benchmarks Configuration Guide.

Add the related smart group you created in step 1 to the scope of the macOS app, configuration profile, or policy.

Add an app in Jamf Pro. For more information, see Content Distribution Methods in Jamf Pro in the Jamf Pro Documentation.
Create a computer configuration profile. For more information, see Computer Configuration Profiles in the Jamf Pro Documentation.

Executing a script.

Example:

The following script notifies users that their devices are out of compliance and directs them to Self Service:

#!/bin/bash

# Define Variables
brandIcon="/Library/Application Support/JAMF/Jamf.app/Contents/Resources/AppIcon.icns"
policyID="X"
#get logged in user
loggedInUser=$( scutil <<< "show State:/Users/ConsoleUser" | awk '/Name :/ && ! /loginwindow/ { print $3 }' )

answer=$( osascript << EOF
button returned of (display dialog "Your computer has fallen out of compliance with our security policies. Please click OK to open Self Service to remediate." buttons {"OK"} default button 1 with icon POSIX file "$brandIcon")
EOF
)

echo "$answer"

if [[ $answer -eq "OK" ]]; then
  su "$loggedInUser" -c "killall Self\ Service"
  su "$loggedInUser" -c "open \"jamfselfservice://content?entity=policy&id=$policyID&action=view\""
fi

Create one additional smart computer group to use for calculating computer compliance:
1. On the Computer Group tab, select the Send email notification on membership change checkbox so that you are notified when a computer falls out of compliance.
2. Click Add .
3. Click Show Advanced Criteria.
4. Select Device Compliance Integration - Compliance Status from the list of criteria and add each of the smart groups you created in step 1.
5. From the Operator pop-up menu, choose "is".
6. Select Non Compliant from the Value list.
7. Click Add .
8. Select Device Compliance Integration - Registration Status from the list of criteria and add each of the smart groups you created in step 1.
9. From the Operator pop-up menu, choose "is".
10. Select Non Compliant from the Value list.
11. Click Save .

You will now be notified by email of any change in compliance, and your users will be able to take action to remediate their non-compliant computers.

Update the smart computer groups at any time to add or remove compliance criteria.