Skip to main content
Compliance Settings is where MSP staff build the checks, groups and run templates used to assess clients. The library is shared across all companies. Company users do not configure it.

Before you start

  • The Compliance feature must be available for your account.
  • Open Settings > Compliance. The tabs you see depend on your permissions and features: Checks, Playbooks, Metrics (needs a Liongard integration), Groups, Runs, Schedule, Scoring and Risk.
  • Permissions differ by action. Add Group, New Check, Add New Template and the Schedule controls need Compliance settings write access. Editing library content needs write access to Compliance. Deleting and approving needs manage access to Compliance. See Permissions.
  • Runs here means reusable run templates, not the history of completed assessments. To run a template on a recurring basis, use Schedule.
The Checks, Groups and Runs tabs share a split-pane layout. The list is on the left and the detail is on the right. Click the panel icon at the top of the list to collapse it.

Organize checks in folders

The Checks tab lists every check your tenant can use. Folders only organize this settings page. They do not change how checks behave in a run.
1

Create a folder

On the Checks tab, click the New folder icon at the top of the Compliance checks list. To nest a folder, open a folder’s menu and click New subfolder.
2

Name it

Enter a name such as “Microsoft 365” or “CIS Controls v8” and click Create.
3

Add checks

Open the folder’s menu and click New check here, or drag existing checks into the folder (see below).
A folder’s menu also has Rename and Delete. Deleting a folder removes its subfolders. Checks inside move to Uncategorized, so no check is lost.

Move checks

1

Select the checks

Click a check to open it on the right. Hold Cmd (macOS) or Ctrl (Windows) and click more checks to add them. Hold Shift and click to select a range. The list shows how many are selected.
2

Drag them to a folder

Drag any selected check onto a folder. The folder highlights while you hover. Drop to move every selected check at once.
3

Or use the menu

For one check, open its Check actions menu and click Move to folder.
To take a check out of a folder, drag it onto Uncategorized at the bottom of the list. If you drag a check that is not in your selection, only that check moves.

Search and filter

Type in the search box to filter by check title. Folders with matches open automatically. Click the filter icon to filter by Approval status, Priority, Criticality, Frequency, Status list or Compliance type. Click Clear all to reset.

Create a check

1

Open the new check form

Click New Check in the page header, or New check here in a folder’s menu. A check made from a folder starts in that folder. Otherwise it starts in Uncategorized.
2

Fill in the check

Enter the details, such as title, description, criticality, priority, frequency, status list and compliance type.
3

Save

Save the check. It appears in the list.
To have AI draft many checks at once, click Bulk Generate with AI in the page header.
AI generation and refinement prompts use the same rounded composer as the assistant. Write your instruction, then select the up-arrow to generate or regenerate. Enter sends; Shift+Enter adds a new line. Review the proposed check and save it from the check editor.
Generate a compliance check with the shared AI composer.

Generate a compliance check with the shared AI composer.

Edit a check

1

Open the check

Click a check in the list. Its form opens on the right.
2

Change the fields

Edit the fields (see the table below). Click Improve with AI to have AI suggest a better description, how-to-check, remediation and references from the title.
3

Save

Click Save in the form header. A toast says Check updated. If you open another check first, MSPortal asks whether to discard your unsaved changes.
Changing the Compliance type can remove group assignments that no longer match when you save. Note-template links and group membership save separately and at once. Cancelling the main form does not undo them. If a save fails partway, such as on custom fields, reopen the check and look at what saved before you retry. Checks have an approval status: Draft, Pending review, Approved or Rejected. Users with manage access can approve a check from its Check actions menu, or select several and click Approve selected. Each check uses a status list that defines its answer choices, such as Pass, Fail and Needs review. You can link a note template to each answer. When an assessor picks that answer in a run, the template text is added to their public notes.
1

Choose a status list

In the check form, pick a Status list. The Note templates by status section appears. Save the check so the status list is stored.
2

Pick a template for each answer

Choose a note template for each answer you want filled in. Leave the others on No template. Each choice saves at once. Clear template removes a link.
3

Assessor picks the answer

In a run, when the assessor picks an answer with a linked template, the template text is added under any existing public notes, after a blank line.
Only templates in the Compliance Check Note category appear. Create them in Settings > Customization > Note Templates first. See Note Templates. The template is applied once per answer and template in a session, so switching between answers does not repeat it.

Choose which companies and devices get a check

By default a check goes to every company, location or device a run covers. Add conditions under Applies to to narrow it. For example, send a FileVault check only to Macs, and a HIPAA check only to healthcare clients.
1

Add a condition

Scroll to Applies to and click Add condition. Choose the Condition, a Comparison such as is any of, and the Value.
2

Combine conditions

With two or more conditions, choose whether the check applies when all conditions match or any condition matches.
3

Save

Click Save in the check header. A toast says Conditions saved. New runs, and checks added to runs, use the conditions. Existing assignments stay as they are.
Device conditions apply only to checks with the Device compliance type. Company, location and control checks use their company conditions and skip device conditions. You can add a limited number of conditions per check.
A company or device with no value for a condition still gets the check. To skip records with no value, use is empty or is not empty. For example, add Operating system is not empty to skip devices whose OS is unknown.

Delete checks

Open a check’s Check actions menu and click Delete, or select several checks and click Delete selected. Both need manage access. Deleting is permanent and removes the check from every group it was in.

Build groups

Groups bundle related checks so you can add a whole set to a run at once. A check can be in any number of groups.
1

Open the Groups tab

Go to Settings > Compliance and click Groups. The list on the left shows every group. Search by name, or filter by compliance type.
2

Click Add Group

Click Add Group in the page header, or the + icon at the top of the list.
3

Fill in the details

Enter a Name and an optional description. Choose a Compliance type. If you pick one, only checks of that type can be added. Choose None (any type) to allow any check. For a Device group, also pick Device types. Devices of those types are evaluated against the group’s checks.
4

Create

Click Create. The group appears in the list and opens on the right.
New group dialog with name, description and compliance type fields and Cancel/Create controls.

New group is an unsaved draft. Choose the compliance type before you create it. Adding checks is a separate step.

If the device-type update fails after the group saves, reopen the group and check what saved before you retry.

Add and remove checks

1

Find the checks

The group page has two columns, Available checks on the left and Members on the right. Each column has its own search box. Click a check to select it. Hold Cmd or Ctrl to add more, or Shift to select a range.
2

Drag them across

Drag from Available checks to Members to add. Drag from Members to Available checks to remove. A toast says how many were added or removed. Each move saves at once, so wait for the toast before the next one.
If the group has a compliance type, only matching checks appear under Available checks. Clear the type to see all checks.

Edit or delete a group

Use the Edit group and Delete buttons in the group header, or the menu on a list row. Deleting a group does not delete its checks. Deleting needs manage access.

Build run templates

A run template bundles groups and individual checks into a reusable assessment package. A run made from the template assigns every check in each member group, plus each individual check.
1

Open the Runs tab

Go to Settings > Compliance and click Runs. The list shows each template with its group and check counts. Filter by All templates, Active only or Inactive only.
2

Click Add New Template

Click Add New Template in the page header, or the + icon at the top of the list.
3

Fill in the basics

Enter a Name (for example, “Quarterly security review”), an optional Description and the Active switch. Inactive templates stay in this list but are left out of the schedule’s template list.
4

Create

Click Create. The template opens on the right with empty Groups and Individual checks tabs.
New template dialog with name, description, Active switch and Cancel/Create controls.

New template starts with Active on. Create saves the template. Add groups and checks afterward.

Add groups and checks to a template

1

Open the Groups tab

On the template, click Groups. Available groups is on the left and Groups in this template on the right.
2

Drag groups across

Drag groups into Groups in this template to add them. Every check in those groups runs whenever the template is used. Drag them back to remove them.
3

Add individual checks (optional)

Click Individual checks for one-off checks that are not in a group. They run in addition to the groups. The drag and drop works the same way.
Group and check moves save at once. Cancelling the template’s edit dialog does not undo them. Groups and individual checks are independent, so you can use either or both.

Activate, edit or delete a template

  • Use the Active switch in the template header, or Activate and Deactivate in the row menu. It saves at once. Turning a template off does not pause schedules that use it, so check your schedules separately.
  • Edit template opens the name, description and active dialog.
  • Delete removes the template. Runs already created from it are not affected. Deleting needs manage access.
Deleting a run template does not stop or change runs already created. It only prevents new runs from it.

Schedule, scoring and risk

Permissions

The page header buttons (New Check, Bulk Generate with AI, Add Group, Add New Template) and the Schedule controls need Compliance settings write access. Scoring and risk changes need Compliance settings manage access.

Keyboard and mouse reference

Best practices

  • Start with folders. Organize checks by framework (CIS, NIST, SOC 2) or domain (Microsoft 365, networking) before the library grows.
  • Use note templates for repeated findings. Link a template to the Fail answer once instead of typing it every assessment.
  • Set a compliance type on groups. It stops mismatched checks being added.
  • Build templates from groups. They are easier to maintain than long lists of single checks.
  • Deactivate, do not delete. Turn a template off with its Active switch to keep its history and keep pickers short.

Troubleshooting

Frequently asked questions

No. Runs here holds reusable templates. See completed assessments in the Compliance workspace.
No. Each drag between columns saves at once.
No. Check your schedules separately. An inactive template is left out of the schedule’s template list.
It can. Only checks of the matching type stay eligible, and a Device group also uses its device types. Check the members afterward.
No. Create a run from the template, or set up a schedule that uses it.
No. The checks stay in the library.