Skip to main content

Policy Center basics

Policy Center is where TvRMM is moving recurring behavior. Use it for settings that should apply consistently across a tenant, organization, sub-organization, or selected endpoints.

What belongs in Policy Center​

Policy Center is the right place for recurring behavior such as:

  • patch deployment and patch approval behavior;
  • agent update behavior;
  • audit and inventory cadence;
  • log collection scope and retention;
  • script policy examples and repeatable script workflows;
  • monitoring and automation defaults;
  • deployment automation examples;
  • remote access policy.

Endpoint detail pages should show effective policy and source when available, then link back to Policy Center for edits.

Starter policies​

New tenants and organizations can include conservative starter policies plus unassigned examples. These are intended to make safe defaults visible without silently turning on risky behavior.

Examples may include scan-only or manual patch baselines, record-only monitoring, log collection examples, script examples, deployment artifact examples, and remote access examples.

Assignment levels​

Policies can be assigned at different levels depending on policy type and tenant structure:

  • tenant baseline;
  • organization;
  • sub-organization;
  • selected endpoint or target profile;
  • explicit No policy to block inheritance.

Agent-level assignment should be treated as an advanced exception, not the default workflow.

What to check before changing a policy​

Before editing or assigning a policy, confirm:

  • the tenant and organization scope;
  • the endpoint type and support state;
  • whether the policy is enabled;
  • whether the policy is assigned or only an example;
  • whether a lower-level assignment overrides the inherited policy;
  • whether an explicit No policy is blocking inheritance.

Troubleshooting​

If a workflow does not behave as expected, check the endpoint's effective policy and assignment source first. Then confirm your role, operating-as cap, endpoint support state, and whether the endpoint has checked in since the policy changed.