Skip to content

Commit 30058a6

Browse files
authored
Update device-control-policies.md
1 parent 6854666 commit 30058a6

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

defender-endpoint/device-control-policies.md

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -200,17 +200,18 @@ Device control policies define access (called an entry) for a set of devices. En
200200

201201
### Entry evaluation
202202

203-
There are two types of entries: enforcement entries (Allow/Deny) and audit entries (AuditAllow/AuditDeny). Enforcement entries for a rule are evaluated in order until all of the requested permissions have been matched. If no entries match a rule, then the next rule is evaluated. If no rules match, then the default is applied.
203+
There are two types of entries: enforcement entries (Allow/Deny) and audit entries (AuditAllow/AuditDeny).
204+
205+
Enforcement entries for a rule are evaluated in order until all of the requested permissions have been matched. If no entries match a rule, then the next rule is evaluated. If no rules match, then the default is applied.
204206

205207
### Audit entries
206208

207-
Audit events control the behavior when device control enforces a rule (allow/deny). Device control can display a notification to the end-user. The user gets a notification that contains the name of the device control policy and the name of the device. The notification appears once every hour after initial access is denied.
209+
Audit events control the behavior when device control enforces a rule (allow/deny). Device control can display a notification to the end-user. The user gets a notification that contains the name of the device control policy and the name of the device. The notification appears once every hour after initial access is denied.
208210

209211
Device control can also create an event that is available in Advanced Hunting.
210212

211213
> [!IMPORTANT]
212-
> There is a limit of 300 events per device per day
213-
Audit entries are processed after the enforcement decision has been made. All corresponding audit entries are evaluated.
214+
> There is a limit of 300 events per device per day. Audit entries are processed after the enforcement decision has been made. All corresponding audit entries are evaluated.
214215
215216
### Conditions
216217

0 commit comments

Comments
 (0)