---
title: "Create and assign a profile"
description: "Create a profile, set its values, assign it to a client, site, device group, endpoint, or person, and make it active."
url: "https://support.outpostplatform.com/automation/create-a-profile/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "Steps to create an Outpost profile under Profiles > All profiles: New profile, name and category, set values on the Settings tab, assign it on the Assignments tab with a scope and rank, then set Status to active. Mandatory needs profile:manage_mandatory. Verify on Profiles > Effective config."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  platforms: ["windows", "linux", "macos"]
  permission: "profile:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/automation/create-a-profile.md"
license: "CC BY 4.0"
---

# Create and assign a profile

This page takes you from an empty profile to one that applies to endpoints.
You finish with an active profile, assigned to the scope you chose, whose
values the agent receives straight away. For how profiles merge, see
[Profiles and policies](/automation/profiles/).

## Before you begin

- You need the `profile:manage` permission. To make a setting or an assignment
  mandatory, you also need `profile:manage_mandatory`.
- The site, device group, or endpoint you want to target exists. See
  [Endpoints](/endpoints/).
- On the MSP plan, open the client's workspace first. Profiles belong to one
  client.

:::caution
A profile starts applying the moment it is **active** and assigned. Settings
such as `patch.install_enabled` or `software.blocked_packages` act on endpoints
without further confirmation. Keep the profile a draft until its values are
right, and test it on one endpoint or a small device group first.
:::

## Create the profile

1. Go to **Profiles** > **All profiles** and select **New profile**.
2. In **Name**, enter a name, such as `Front desk kiosk`.
3. Optionally, in **Category**, enter a category. It defaults to `general`.
   Names must be unique within a category.
4. Optionally, in **Description**, say what the profile is for.
5. Leave **Status** as **Draft (default)**, so nothing applies while you fill it
   in.
6. Select **Create profile**. The profile opens on its **Settings** tab.

## Set its values

1. On the **Settings** tab, find a setting. Enter part of its key or
   description in **Search settings**, or open a category.
2. Select **Set in this profile**. Until you do, the setting is inheriting: a
   wider scope or the catalog default decides it.
3. Enter or choose the value.
4. To give one operating system a different value, select **Show per-OS
   variants**, choose the system in **Add a variant for...**, select **Add
   variant**, and set its value. The base value applies everywhere else.
5. To pin the value so no narrower scope can override it, select
   **Mandatory**. This needs `profile:manage_mandatory`.
6. Select **Save** on the setting. Each setting saves on its own. **Revert**
   discards unsaved changes, and **Remove from profile** deletes the stored
   value.
7. Repeat for each setting. Select **Only settings this profile sets** to list
   what the profile holds so far.

The [Policy settings reference](/automation/policy-settings/) lists every
setting with its type, default, and platforms.

## Assign it

1. Open the **Assignments** tab and select **Assign this profile**.
2. In **Applies to**, choose the scope: **Whole client**, **Site**, **Device
   group**, **Endpoint**, **User group**, **Person**, or **Technician**.
3. Choose the site, group, endpoint, or person. For **Technician**, enter the
   technician's id.
4. Optionally, enter a **Rank**. Leave it blank to take the default for the
   scope, which the form shows. A higher rank beats a lower one.
5. Optionally, select **Mandatory** to make every setting this assignment
   carries mandatory. This needs `profile:manage_mandatory`.
6. Select **Assign**.

The assignments list is in merge order, so the last row wins a contested
setting unless a mandatory assignment overrides it. If two assignments share a
rank, the page warns you. Give them different ranks.

## Make it active

1. Open the **Overview** tab.
2. In **Status**, choose `active`.
3. Select **Save changes**.

Connected endpoints in the assigned scopes receive the new policy straight
away. Endpoints that are offline receive it when they reconnect.

## Verify

1. Go to **Profiles** > **Effective config**.
2. In **Endpoint**, choose an endpoint the profile is assigned to, and select
   **Resolve**.
3. Under **Profiles applied**, your profile is listed with its rank and the
   number of **Settings won**. **Outranked everywhere** means another profile
   beat it on every setting it sets.
4. In the settings table, your values show **Won by rank** or **Mandatory** in
   **Decided by**, and your profile in **Winning profile**.

See [Check an endpoint's effective configuration](/automation/effective-configuration/)
for what the **Enforced** column tells you.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| The profile is not under **Profiles applied** | The profile is a draft or archived, or the endpoint is outside the assigned scope. | Set **Status** to `active`, and check the assignment's scope. |
| A value shows **Compliance limit** in **Decided by** and **Clamped from** your value | A compliance framework declared for this scope requires a stronger value. | Choose a value that meets the framework. See [Compliance](/compliance/). |
| Settings show **Monitor only** or **Drift detected** | `enforcement.mode` is `monitor`, the default. | Set `enforcement.mode` to `enforce` on a profile that applies. See [Enforcement mode](/automation/profiles/#enforcement-mode). |
| **Mandatory** cannot be selected | You lack `profile:manage_mandatory`, the setting is not set in this profile, or the catalog does not allow pinning it. | Ask an owner for the permission, or select **Set in this profile** first. |

## Next steps

- [Check an endpoint's effective configuration](/automation/effective-configuration/)
- [Policy settings reference](/automation/policy-settings/)