Tablet Fleet MDM Compliance Simulator

MDM Policy Controls

Compliance threshold 55

Heartbeat interval 2.0s

Simulate configuration drift (unpatched OS, disabled encryption, sideloaded apps) Remote-wipe after 3 unresolved grace periods

Fleet Status

Compliant

30 / 30

In grace period

Quarantined

Wiped (session)

Compliant — encrypted, patched, locked

Grace period — remediation window open

Quarantined — network access restricted

How it works

Every enrolled tablet carries a risk score R (0–100) built from four real MDM-checked signals: disk encryption state, screen-lock/passcode presence, OS patch age, and unauthorized ("sideloaded") apps. Each heartbeat, drift nudges R at random:

R(t+Δt) = clamp(R(t) + drift·U(0,1)² · k, 0, 100)

At every heartbeat the MDM server compares each device's R against the admin-set compliance threshold T:

R ≤ T — device stays compliant, full network access.
R > T — device enters a grace period: a push notification asks the user to re-enable encryption/lock/update; if R falls back under T before the next heartbeat, it recovers automatically.
Grace period expires without recovery — the device is quarantined: conditional-access policy pulls it off the corporate Wi-Fi / VPN profile until it re-complies.
Repeated failure (3 heartbeats quarantined, if enabled) — the MDM server issues a remote enterprise wipe, resetting the device's managed profile to a fresh, compliant enrollment.

Push policy now simulates an admin forcing a full profile re-push (enforced FDE, passcode policy, forced OTA update) — it drops every device's risk score back toward baseline immediately, the same lever a real IT admin pulls from Intune, Jamf or Workspace ONE during an incident.

This is the same enforcement ladder — check-in → grace → conditional-access quarantine → remote wipe — that keeps a lost or drifting tablet from becoming a data-exfiltration path in a real enterprise fleet.

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.