Overview
The devices module provides a centralized inventory of all employee devices with real-time compliance monitoring powered by the LowerPlane Desktop Agent. The agent automatically reports encryption status, antivirus coverage, firewall settings, screen lock configuration, OS updates, and MDM enrollment — eliminating manual device audits.Device Coverage
The dashboard shows a Device Coverage metric comparing the number of active employees who have the agent installed versus total active employees. Aim for 100% coverage to ensure full endpoint compliance visibility.Device coverage is calculated as: (unique employees with agent-reported devices / total active employees) × 100%
How Devices Are Registered
Devices are registered automatically when an employee installs and signs into the LowerPlane Desktop Agent. No manual device entry is needed.1
Employee Installs Agent
The employee downloads the Desktop Agent from the Employee Portal (Devices > Download Agent) and installs it on their work device.
2
Employee Signs In
The employee signs in with their company email. The agent links the device to their LowerPlane account.
3
Agent Reports Automatically
The agent runs security checks and reports results to the dashboard. The device appears in the admin’s device inventory automatically.
4
Continuous Monitoring
The agent syncs periodically, keeping compliance status up to date without any manual action.
Compliance Monitoring
The agent performs the following security checks on each device:Required Security Controls
Recommended Controls
Recommended controls don’t affect overall compliance status but are tracked for security posture visibility.
Compliance Status
Based on the required checks, each device receives an overall status:Security Controls Coverage
The admin dashboard shows aggregate coverage for each security control across all devices:- Encryption — X of Y devices encrypted
- Antivirus — X of Y devices with antivirus
- Firewall — X of Y devices with firewall enabled
- Screen Lock — X of Y devices with screen lock configured
- MDM Enrolled — X of Y devices enrolled in MDM
Device Properties
Each agent-reported device includes:Device Statuses
Admin Actions
Sync Devices
- Sync All — Refresh all device data from connected MDM integrations (Jamf, Intune, Kandji, etc.)
- Agent-reported devices sync automatically — no manual sync needed
Edit Device
Admins can update device metadata and security check values manually if needed (e.g., to correct a check that the agent couldn’t detect).Export
Export the full device inventory to CSV for reporting, asset management, or audit evidence.Retire / Delete
Mark devices as retired when decommissioned, or delete device records that are no longer needed.MDM Integration
If your organization uses an MDM solution connected through LowerPlane integrations, device data from both the Desktop Agent and MDM are merged:
Both sources contribute to the device’s compliance status. The agent provides the security check results; MDM provides management and enforcement.
Compliance Mapping
Device management supports endpoint security controls across frameworks:Best Practices
- Deploy the Desktop Agent to all employees — aim for 100% device coverage
- Require full-disk encryption on all devices — this is a baseline control for every compliance framework
- Set auto-lock timers with password required — the agent checks both timeout and authentication
- Monitor check-in freshness — devices that haven’t checked in recently may need attention
- Enroll devices in MDM for remote management and enforcement capabilities
- Review non-compliant devices weekly and follow up within 7 days
- Wipe devices before reassignment to prevent data leakage between employees