Device management channels
Understand Agent, Apple MDM, Windows MDM, and osquery evidence before acting on a device.
Read channel state separately
The Agent, Apple MDM, Windows MDM, and osquery sidecar have different identities, transports, and retry behavior. Grydor does not collapse them into a single online flag.
| Channel | Primary responsibility | Healthy evidence |
|---|---|---|
| Agent | Inventory, software, scripts, task journal | Signed check-in and current inventory snapshot |
| Apple MDM | Native policy and device commands | Valid enrollment, APNs wake, device check-in, command result |
| Windows MDM | CSP policy and device commands | Valid certificate, authenticated OMA-DM session, correlated result |
| osquery sidecar | Scheduled endpoint facts | Signed generation, bounded results, acknowledged log cursor |
Before a destructive action
Verify the device identity, last channel timestamps, platform support, and current operator permission. Remote wipe and credential-recovery workflows require additional production security review and explicit confirmation; an Agent heartbeat alone is not sufficient evidence that an MDM action can execute.