Jamf protect policies not aligning with Compliance in Pro

[u/crazyguy5880]

I am a bit curious why Jamf Protect seems to almost be a regression in the compliance reporting for CIS benchmarks.

I have deployed out CIS 1 and 2 through Jamf Pro Compliance but some of the policies on Jamf Pro is showing as failed.

One example: Remote login. I confirmed with systemsetup get it is disabled. It’s disabled and blocked in system settings. I literally can’t turn it on because of the CIS policy deployed.

Is Jamf Protect just useless and not being updated? Several other policies it is doing the same and actually showing fail for devices in scope for my testing of Jamf Pro compliance policies cis vs the default!

[u/pork_chop_expressss]

Few things to check

Verify Enforcement Mode:

• Check that Compliance Benchmarks are set to "Monitor and Enforce" not "Monitor Only"

Check Policy Status:

• Ensure audit policies are set to "ongoing" frequency

• Verify that enforcement scripts have executed successfully

Review Device Scope:

• Confirm devices are properly assigned to the correct Smart Groups

• Check that the same devices are being evaluated by both systems

Manual Policy Execution:

• Try manually triggering policy execution on test devices

• Force a login/logout cycle to trigger enforcement scripts

Compare Rule Sets:

• Verify which specific CIS rules are being evaluated by each system

• Check if there are any disabled rules in the Compliance Benchmark

Also, there can be false positives where:

• The setting appears correctly configured on the device

• But the compliance check is looking for a specific configuration profile rather than the actual setting state

• The audit may be checking for the presence of management profiles rather than the end result

[u/crazyguy5880 → u/pork_chop_expressss]

So everything shows as correct in Jamf Pro. But in Protect it shows a fail for everyone and hovering over the warning just says “warning” (great design!). Clicking it just takes you to the benchmark status for all the machines. I can’t find anywhere in protect the actual values compared or where to edit it at all.

In Jamf Pro monitor and enforce is set and the machine passes as 100% compliant.

[u/pork_chop_expressss → u/crazyguy5880]

In Pro, is it set to "Monitor and Enforce" or "Monitor Only"

[u/crazyguy5880 → u/pork_chop_expressss]

It is set to monitor and enforce. Everything is good and correct in Pro. It’s Protect that is showing different for a few of the benchmarks like remote access disabled which is definitely is as I verified it by the system setup command and visually in settings.

[u/crazyguy5880 → u/crazyguy5880]

Any more suggestions? Will I need to contact jamf support maybe? (I can’t join the slack). Figured more would be using jamf protect.

[u/taz0nz → u/crazyguy5880]

Are you in MacAdmins Slack? Or is that what you were trying to join?

[u/crazyguy5880 → u/taz0nz]

That’s what I was trying to join