On this page0
Guide
Push a compliance profile
Turn on security settings such as the firewall and automatic updates across your Macs, Linux and Windows devices, then check which devices prove it.
Before you start
- This is an IT task. It assumes you look after your company’s computers and know what a firewall, a screen lock and disk encryption do on them. If that is not you, do this together with the person who does.
- At least one device enrolled. Until a platform is set up, “Profiles” is greyed out in the sidebar. See Enroll a device.
- Your role can manage devices. In the built-in set, administrators have that permission, and so do members of the “IT” group. With view-only access you can read profiles and coverage, but the “New profile” button does not appear.
- For locked macOS settings (Screen Lock, FileVault): the Apple push certificate installed. Without it the profile screen shows “Push certificate missing”.
Know what each platform can do
Step 1: Enforced, or only reported
macOS has two kinds of setting. Settings tagged MDM are locked by Apple and the user cannot change them: Screen Lock, FileVault and installing the Zonitix agent. Everything else (firewall, Gatekeeper, turning off SSH and screen sharing, updates) is set by the Zonitix agent at each check-in.
Linux and Windows have no MDM lock. Every setting is applied by the agent: firewall, automatic updates, auditd, time sync and fail2ban on Linux; firewall, Microsoft Defender and Windows Update on Windows.
The Linux firewall setting blocks other inbound traffic. With ufw it allows SSH, sets inbound traffic to deny by default and switches the firewall on; with firewalld it starts the firewall and adds SSH. It reports failed when neither is installed. Add a rule for any other service the machine serves before you enable it.
Disk encryption is never switched on by the agent. On a Mac it can be required only by the locked FileVault setting through Apple MDM; on Linux and Windows it is reported.
BitLocker on Windows is report-only. It appears as “BitLocker (report)” and cannot be added to a profile. Zonitix shows whether it is on, but does not turn it on.
Create and assign a profile
Step 2: Open Profiles
Go to DevicesProfiles. Pick a platform tab (“macOS”, “Linux” or “Windows”). You will usually see a profile named like “Baseline · macOS”: it holds your fleet-wide settings for every device on that platform. Edit it for fleet-wide changes, or add a new profile for a narrower group.
Step 3: Start a new profile
Click “New macOS profile” (or the Linux or Windows version). Under “Platform”, confirm the platform and click “Continue”. You only see settings that platform supports.
Step 4: Pick the settings
Under “Settings”, click “+ Add” on each setting you want. Some settings ask for a value, such as the screen lock timing or an agent version. Click “Continue”.
Step 5: Choose who gets it
Under “Who gets it”, choose “All Macs” (every enrolled device, including ones that enroll later), a set of groups, or “Specific Macs”. You can also “Add exclusions” for groups or devices that should be left out.
Step 6: Name, review and create
Under “Review”, give it a “Profile name”, check what each device will get, and leave “Enabled” on. Click “Create”. If the profile has a locked macOS setting, click “Create and deploy” to push it now.
Step 7: Let it reach the devices
Agent settings apply the next time each device checks in. Locked macOS settings go out when you deploy; you can push them again with “Deploy” on the profile’s row. Click the “Deployment” count on the row to see each device’s status.
Approve new devices
Step 8: Clear pending devices
A brand-new device can arrive as “Pending approval” in DevicesInventory. Pending devices are not trusted: no profile applies to them and they are not scored for compliance. Click “Approve” on the row once you recognise the device.
Read compliance coverage
Step 9: Open the coverage view
On the Profiles page, switch the toggle at the top to “Compliance coverage”. Pick a framework tab (“SOC 2”, “ISO 27001”, “HIPAA”, “PCI DSS”, “NIST CSF”, “HITRUST”) or “All frameworks”.
Step 10: Read each row
Each requirement shows which profile enforces it and how many devices prove it:
- “Proven”: the device reports the setting is on.
- “Enforced (MDM)”: a locked profile is confirmed installed.
- “Passing · not enforced”: it is on today, but nothing keeps it on.
- “Failing”: the device reports it is off.
Where nothing enforces a requirement, click “Create profile” (or “Enforce”) on the row to start a profile with that setting already ticked. “Details” lists the devices behind the numbers.
What you should see
Your profile appears on its platform tab with its settings and scope, and its deployment count fills in as devices check in.
In “Compliance coverage”, the requirement moves toward “Proven” or “Enforced (MDM)”. Device evidence is one input to a control; policies and reviews still count.
If something goes wrong
- Profiles is greyed out in the sidebar.
- No platform is set up yet. Enroll a first device from Devices, Settings.
- A device never receives the profile.
- Check it is not Pending approval in Inventory, and that it is not excluded from the scope. Agent settings arrive at the next check-in, so an offline device waits.
- "Push certificate missing" on the macOS tab.
- Locked MDM settings queue until the certificate is installed. Click Install certificate.
- The deploy message says some Macs "are on a previous push topic".
- Those Macs enrolled under an older push certificate and will not receive locked settings until they re-enroll.
- BitLocker stays Failing on Windows devices.
- Zonitix only reports BitLocker today; it cannot turn it on. Turn BitLocker on for those machines yourself; Zonitix picks up the change when they next report.
Still stuck? See When something goes wrong, or Contact Zonitix support.