> For the complete documentation index, see [llms.txt](https://docs.stepsecurity.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.stepsecurity.io/developer-machines/device-policy/profiles.md).
# Profiles
Profiles are bundles of policies that you assign to devices or export to your MDM. Create a policy first, then compose it into a profile. See [Policies](/developer-machines/device-policy/policies.md).
The **Profiles** page under **Developer Machines** > **Device Policy** lists all profiles with the policies they contain, their agent assignment, and their compliance status.
Click **New profile** to create one and select a policy
Each profile has two tabs: **Delivery**, where you deploy the profile to devices, and **Compliance**, where you track which devices have applied it.
### Delivery
Deploying a profile is a two-step process:
1. **Deploy**: download a file for your own MDM, or assign the profile to devices for the DMG agent to enforce (coming soon).
2. **Verify**: devices pick the profile up the next time they connect, usually within hours. See which ones applied it in the Compliance tab.
The **Enforces** section lists the policies in the profile, with their mode, category, IDE, and rule count.
#### Your MDM Enforces
This delivery method is best for devices already managed in an MDM. Download the per-OS artifact, then import and assign it in your own MDM (Intune, Jamf, Kandji), where the OS enforces it. Because enforcement happens at the OS level, the policy is tamper-proof for the developer. Use **Download all (.zip)** to get every artifact at once, or download them individually:
**macOS**
* **Configuration profile** (`.mobileconfig`): import into Intune, Jamf, or Kandji as a custom configuration profile, then assign it to the target device group.
* **Preference file** (`com.microsoft.VSCode.plist`): import into Jamf via Application & Custom Settings, or into Intune as a preference file, using the preference domain `com.microsoft.VSCode`.
**Windows**
* **Remediation script** (`.ps1`): deploy through Intune as a platform script to enforce the policy across your managed Windows devices.
**Linux**
* **Policy file** (`policy.json`): save to `/etc/vscode/policy.json` and roll it out through your preferred MDM or configuration-management channel.
#### DMG Agent Enforces
This delivery method is best for devices that already run the DMG agent. The agent installs and continuously enforces the profile, no MDM required, making it tamper-resistant. It requires DMG agent version 1.13.0 or later. You choose which devices the profile applies to:
* **All devices**: every current and future registered device.
* **Specific devices**: pick devices from the fleet. You can search by hostname, user, or device ID.
Click **Save assignment** to apply your selection. Agents pick the profile up on their next cycle, and at most one profile applies to any device.
### Compliance
The **Compliance** tab shows every device the profile applies to and its current state, so you can verify the rollout. For each device you can see the platform, the enforcement state (for example, "Agent update required"), when the device was last seen, when the profile was last evaluated, and the agent version. Devices that have not connected recently are counted as offline.
### Manage Profiles with Terraform
You can manage profiles and their policies as code using the [StepSecurity Terraform provider](https://registry.terraform.io/providers/step-security/stepsecurity/latest). Click **Use with Terraform** on a profile to open a guided, one-time import flow with commands prefilled for that profile. You can also download the instructions as Markdown.
1. **Set up the provider**: save the generated `provider.tf`, which configures the `step-security/stepsecurity` provider and authenticates via the `STEP_SECURITY_API_KEY` and `STEP_SECURITY_CUSTOMER` environment variables, then run `terraform init`.
2. **Add import blocks**: the panel generates one import block for the profile and one for each attached policy, prefilled with your IDs, using the `stepsecurity_developer_mdm_profile` and `stepsecurity_developer_mdm_ide_extension_policy` resources.
3. **Generate the config, review, apply**: run `terraform plan -generate-config-out=generated.tf`, review `generated.tf` before committing, then apply. From that point on, changes to the profile and its policies can be managed through Terraform.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://docs.stepsecurity.io/developer-machines/device-policy/profiles.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.