VERISCO Shield Protect
Safe Rollout
Turning a policy on without locking anybody out. A checklist computed from your own data, and a what-if for a change you have not made yet.
Watch mode made a safe rollout possible, but nothing told you what "safe" consisted of or whether you had done it. The usual failure is switching to enforce when it feels right: on a Monday, after two days of data, with a travelling sales team nobody looked at.
Open Safe Rollout in your console.
The checklist#
One checklist per policy, five steps each. You cannot tick a step. It becomes done when your data says so.
| Network policy | Device policy |
|---|---|
| The sign-in path is proven | Device agents are reporting |
| The policy is watching | The policy is watching |
| It has watched for long enough | It has watched for long enough |
| What it would stop has been looked at | Failing devices have been looked at |
| Enforce | Enforce |
Each step links to the page where you do it.
The what-if#
Describe a change, and see who it would have affected, measured against the sign-ins you already have. Nothing is saved and nobody is affected.
Use it before:
- adding a country to the block list;
- switching on VPN blocking;
- raising the device score a machine must reach.
Use a window wide enough to include people who travel
A policy that looks harmless over three quiet days is the one that strands someone on a business trip. Look at a month, not a weekend.
A rollout that works#
-
Watch
Switch the policy to watch and leave it for at least two working weeks.
-
Read
Open the list of people and devices it would have stopped. Each one is either a real problem or a rule that is too tight.
-
Fix or exempt
Add the office range to trusted ranges. Get the three laptops updated. Decide what to do about the consultant abroad.
-
Tell people
Say when enforcement starts and what someone should do if they are stopped.
-
Enforce
Then keep reading Sign-in Activity for the first week.
Something missing or wrong on this page? Tell us and we will fix it.