Configure collection, commands, and rollout policies
Create a scoped policy and configure each agent module, collection filters, remote-action approvals, and staged updates.
Before you start
- Know which tag or OU identifies the devices you intend to change.
- MFA available for protected policy changes.
- For workforce activity, a current tenant notice attestation and the separate access arrangements described in Workforce privacy.
Screenshots show the Rapport interface with example data. Use your organization’s devices and values. Select an image to view it at full size.
Select an existing policy or create one
Open Admin → Agent policies. Select a policy in the Policies list to inspect its scope, version, and priority, or choose New policy. A new policy starts from the current tenant default configuration. Give it a descriptive Name, such as Finance laptop pilot, rather than relying on the generated name.
Set scope and policy polling
Choose All agents (tenant default), By tag, or By OU under Scope. For a targeted policy, enter the exact Tag value or OU value used by the endpoints. Set Priority to control precedence when multiple policies match; higher priority wins. Check Policy enabled. Config poll interval (seconds) controls how frequently agents fetch configuration; lower values allow quicker propagation within the permitted limits.
Configure baseline collection modules
For each module, use its enable switch and interval field. Heartbeat reports presence. Inventory → Collect selects inventory categories. Telemetry → Metrics selects health measurements, and Top processes N limits the process list from 0 to 25. DEX events → Events selects experience events; Issue sensors controls issue detection. Keep only the collections you need, and use the displayed minimums when entering intervals.
Define operation timing and workforce activity
In Operation timing, set Sample interval (s) and choose Add operation detector. Enter a stable operation ID such as engineering.full_build, exact executable basenames such as go or MSBuild.exe, minimum duration in milliseconds, and maximum duration in seconds. The minimum must exceed the sampling interval; expand How this is measured to review timing uncertainty. Workforce activity (sensitive) independently controls daily active/idle and coarse category totals.
Control commands and the device assistant
Enable Remote commands only for the intended devices. Select Allowed types, then use Always require approval for to identify command types requiring a second admin on every covered device. Other privileged work follows Settings → Approvals and MFA. Enable Device assistant and set its polling interval if technicians should start conversations from endpoint pages. The model, key, and conversation budget are configured separately in AI Assistant.
Configure a staged signed update
Enable Signed agent updater, set Check interval (s), then choose a Rollout ring and Rollout percentage. The ring caps are Canary 5%, Pilot 25%, Broad 75%, and General 100%; 0% keeps the target inert. Set Rollout window (s) for the observation window. Last selected release is read-only: choose and approve releases in Agent releases. Emergency halt withholds future targets and leaves already-installed versions in place.
Apply collection filters and diagnostic verbosity
Under Filters, enter Process blocklist items, such as lsass.exe, and Redact paths patterns, such as C:\Users\*\Documents, for the collection exclusions you require. Choose Log level from debug, info, warn, or error. Review these together with module selections so you do not enable a collection while unintentionally removing the evidence you expect it to produce.
Save and verify the effective result on devices
Choose Save, complete MFA if prompted, and verify the saved policy version and time. Wait for policy polling, then inspect a matching device’s module/capability and fresh telemetry reports. Revisit Agent releases if the policy needs a new release approval. To stop using a policy, switch Policy enabled off and save, then verify the replacement effective configuration. The trash control deletes a removable policy after Delete this policy? and MFA; check the selected policy before confirming.
If something doesn’t work
A device is not receiving the expected settings.
Check Enabled, exact tag/OU match, competing policy priority, config polling, and the device’s last heartbeat. Inspect the selected policy’s saved version rather than relying on unsaved controls.
Workforce activity stays off.
Check the current Workforce privacy attestation, endpoint local opt-out, reported platform capability, and module enablement. The collection request alone is not sufficient.
An action is still waiting for approval.
Check Always require approval for on the effective policy and the organization’s Approvals and MFA settings. Enabling a command type permits its use but does not remove approval requirements.