Create and assign a profile

This page takes you from an empty profile to one that applies to endpoints. You finish with an active profile, assigned to the scope you chose, whose values the agent receives straight away. For how profiles merge, see Profiles and policies.

Before you begin

• You need the profile:manage permission. To make a setting or an assignment mandatory, you also need profile:manage_mandatory.
• The site, device group, or endpoint you want to target exists. See Endpoints.
• On the MSP plan, open the client’s workspace first. Profiles belong to one client.

Caution

A profile starts applying the moment it is active and assigned. Settings such as patch.install_enabled or software.blocked_packages act on endpoints without further confirmation. Keep the profile a draft until its values are right, and test it on one endpoint or a small device group first.

Create the profile

1. Go to Profiles > All profiles and select New profile.
2. In Name, enter a name, such as Front desk kiosk.
3. Optionally, in Category, enter a category. It defaults to general. Names must be unique within a category.
4. Optionally, in Description, say what the profile is for.
5. Leave Status as Draft (default), so nothing applies while you fill it in.
6. Select Create profile. The profile opens on its Settings tab.

Set its values

1. On the Settings tab, find a setting. Enter part of its key or description in Search settings, or open a category.
2. Select Set in this profile. Until you do, the setting is inheriting: a wider scope or the catalog default decides it.
3. Enter or choose the value.
4. To give one operating system a different value, select Show per-OS variants, choose the system in Add a variant for…, select Add variant, and set its value. The base value applies everywhere else.
5. To pin the value so no narrower scope can override it, select Mandatory. This needs profile:manage_mandatory.
6. Select Save on the setting. Each setting saves on its own. Revert discards unsaved changes, and Remove from profile deletes the stored value.
7. Repeat for each setting. Select Only settings this profile sets to list what the profile holds so far.

The Policy settings reference lists every setting with its type, default, and platforms.

Assign it

1. Open the Assignments tab and select Assign this profile.
2. In Applies to, choose the scope: Whole client, Site, Device group, Endpoint, User group, Person, or Technician.
3. Choose the site, group, endpoint, or person. For Technician, enter the technician’s id.
4. Optionally, enter a Rank. Leave it blank to take the default for the scope, which the form shows. A higher rank beats a lower one.
5. Optionally, select Mandatory to make every setting this assignment carries mandatory. This needs profile:manage_mandatory.
6. Select Assign.

The assignments list is in merge order, so the last row wins a contested setting unless a mandatory assignment overrides it. If two assignments share a rank, the page warns you. Give them different ranks.

Make it active

1. Open the Overview tab.
2. In Status, choose active.
3. Select Save changes.

Connected endpoints in the assigned scopes receive the new policy straight away. Endpoints that are offline receive it when they reconnect.

Verify

1. Go to Profiles > Effective config.
2. In Endpoint, choose an endpoint the profile is assigned to, and select Resolve.
3. Under Profiles applied, your profile is listed with its rank and the number of Settings won. Outranked everywhere means another profile beat it on every setting it sets.
4. In the settings table, your values show Won by rank or Mandatory in Decided by, and your profile in Winning profile.

See Check an endpoint’s effective configuration for what the Enforced column tells you.

If something goes wrong

Symptom	Cause	Fix
The profile is not under Profiles applied	The profile is a draft or archived, or the endpoint is outside the assigned scope.	Set Status to active, and check the assignment’s scope.
A value shows Compliance limit in Decided by and Clamped from your value	A compliance framework declared for this scope requires a stronger value.	Choose a value that meets the framework. See Compliance.
Settings show Monitor only or Drift detected	enforcement.mode is monitor, the default.	Set enforcement.mode to enforce on a profile that applies. See Enforcement mode.
Mandatory cannot be selected	You lack profile:manage_mandatory, the setting is not set in this profile, or the catalog does not allow pinning it.	Ask an owner for the permission, or select Set in this profile first.

Next steps

• Check an endpoint’s effective configuration
• Policy settings reference