MDM Fleet Compliance Enforcement (2D)

MDM Policy

Compliance threshold 0.60

Grace period 10 s

Device drift rate 0.12 /s

Fleet Status

Fleet compliance

100.0%

In grace period

Quarantined

Wiped & re-enrolling

Legend

Compliant Grace period (notified) Quarantined (network cut) Remote-wiped / re-enrolling

How it works

Every device carries a risk score r ∈ [0,1] built from its live posture checks (OS patch level, encryption, passcode, jailbreak/root status). Each tick it random-walks:

P(event in dt) = driftRate · dt
on event:  r ← min(1, r + U(0.10, 0.40))
if auto-remediation & compliant/grace:
  r ← max(0, r − 0.05 · dt)   (MDM push-config)

The policy engine is a state machine driven by the compliance threshold τ and grace period g:

compliant  --(r > τ)-->        grace, timer = g
grace      --(r drops < 0.9τ)--> compliant
grace      --(timer runs out)--> quarantined, timer = 8s
quarantined --(timer out, r > τ)--> wiped, cooldown = 6s
quarantined --(timer out, r ≤ τ)--> compliant
wiped      --(cooldown out)-->  compliant, r = 0 (factory reset)

Compliant — meets policy; MDM can still push config updates.
Grace period — a real MDM (Intune, Workspace ONE) notifies the user and gives them a fixed window to self-remediate before enforcement.
Quarantined — network access revoked; isolated from the MDM server, so auto-remediation cannot reach it — only time (and luck) can bring its risk back down.
Wiped — still non-compliant when the grace+quarantine window closes, so the device is remote-wiped and re-enrolls from a clean image.
Push Fix button simulates an admin manually forcing a config push to every device currently in the grace state.

Turning auto-remediation off shows why it matters: with no self-healing, risk only ever climbs, and the whole fleet cascades into quarantine and wipe cycles.

Drag the fleet grid to pan, scroll/pinch to zoom — useful once devices spread out under quarantine displacement.

Device fleet (drag to pan / scroll to zoom) 100%

Fleet compliance % — last 60s

Risk-score distribution