Policies and violations

How it works

Policies

A policy is built on one primary object type, such as Teams or users, and a filter that describes the objects you do not want, for example Teams whose owners all have disabled accounts. You build the filter in the Policy Builder and can add conditions on related objects.

You start from the “Policy Template Library”, build a policy from scratch, or create one from a report. When you save a policy, you save it as a draft or turn it on right away. An active policy shows results from the data of the last scan, and is recalculated as scans update the inventory.

Some screens and older pages call policies checks.

Violations

A violation is one object that matches the rule of an active policy. For each policy, Rencore Governance shows the total, new and removed violations and a trend over time. You can summarize violations by a related object, for example one row per site owner instead of one per site.

Severity and category

Property	Values	What it is for
Severity	Information (lowest), Low, Medium, High, Critical (highest)	How much impact a violation has. Sorts the top issues on the Policies page.
Category	Security, Costs, Operation, Sprawl, External Access, Adoption, User Offboarding, Response Accuracy	The governance goal. Groups policies on the Policies page and filters the template library. You can also type a custom category.

Severity applies to policy violations. Automations and built-in actions are rated with a criticality level instead.

The compliance score

The Policies landing page shows one tile per connector, or per category if you switch the “Service, Category” selector. Each tile shows the compliance score as a gauge with a percentage, and the five policies with the most violations in the selected period, sorted by severity and violation count. The date range selection defaults to Last 30 Days and can be set to Last 90 Days, This Month, This Year or a Custom Range.

Click a policy title to open the policy and its current violations. Click its trend to open a side panel with the policy logic, the total, new and removed violations, how many objects of that type break the rule (for example 807 of 1,150 users), and the automations the policy triggers.

Example

You turn on the template “Teams with very few owners” (severity High). It lists every Team that has one owner or none. Each of those Teams is a violation. The Teams tile on the Policies page shows the policy among its top issues, and its violations count toward the compliance score of that tile. When a Team gets a second owner, it no longer matches the rule and is counted as removed.

How it relates to other concepts

• Policies are queries over the inventory. A report is also a query, but it shows data without counting anything as a violation. You can turn a report into a policy.
• A violation can trigger an automation with the trigger On Policy Violation. It runs after the next scan of the connector, and again for each object as long as it stays a violation. See Built-in actions, automations and automation actions.
• Policy tiles can be added to dashboards, where hovering over a tile takes you to the policy.
• A Virtual Environment has its own policies.