Profiles

Profiles are bundles of policies that you assign to devices or export to your MDM. Create a policy first, then compose it into a profile. See Policies.

The Profiles page under Developer Machines > Device Policy lists all profiles with the policies they contain, their agent assignment, and their compliance status.

Click New profile to create one and select a policy

Each profile has two tabs: Delivery, where you deploy the profile to devices, and Compliance, where you track which devices have applied it.

Delivery

Deploying a profile is a two-step process:

1. Deploy: download a file for your own MDM, or assign the profile to devices for the DMG agent to enforce (coming soon).
2. Verify: devices pick the profile up the next time they connect, usually within hours. See which ones applied it in the Compliance tab.

The Enforces section lists the policies in the profile, with their mode, category, IDE, and rule count.

Your MDM Enforces

This delivery method is best for devices already managed in an MDM. Download the per-OS artifact, then import and assign it in your own MDM (Intune, Jamf, Kandji), where the OS enforces it. Because enforcement happens at the OS level, the policy is tamper-proof for the developer. Use Download all (.zip) to get every artifact at once, or download them individually:

macOS

• Configuration profile (.mobileconfig): import into Intune, Jamf, or Kandji as a custom configuration profile, then assign it to the target device group.
• Preference file (com.microsoft.VSCode.plist): import into Jamf via Application & Custom Settings, or into Intune as a preference file, using the preference domain com.microsoft.VSCode.

Windows

• Remediation script (.ps1): deploy through Intune as a platform script to enforce the policy across your managed Windows devices.

Linux

• Policy file (policy.json): save to /etc/vscode/policy.json and roll it out through your preferred MDM or configuration-management channel.

DMG Agent Enforces

This delivery method is best for devices that already run the DMG agent. The agent installs and continuously enforces the profile, no MDM required, making it tamper-resistant. It requires DMG agent version 1.13.0 or later. You choose which devices the profile applies to:

• All devices: every current and future registered device.
• Specific devices: pick devices from the fleet. You can search by hostname, user, or device ID.

Click Save assignment to apply your selection. Agents pick the profile up on their next cycle, and at most one profile applies to any device.

Compliance

The Compliance tab shows every device the profile applies to and its current state, so you can verify the rollout. For each device you can see the platform, the enforcement state (for example, "Agent update required"), when the device was last seen, when the profile was last evaluated, and the agent version. Devices that have not connected recently are counted as offline.

Manage Profiles with Terraform

You can manage profiles and their policies as code using the StepSecurity Terraform provider. Click Use with Terraform on a profile to open a guided, one-time import flow with commands prefilled for that profile. You can also download the instructions as Markdown.

1. Set up the provider: save the generated provider.tf, which configures the step-security/stepsecurity provider and authenticates via the STEP_SECURITY_API_KEY and STEP_SECURITY_CUSTOMER environment variables, then run terraform init.
2. Add import blocks: the panel generates one import block for the profile and one for each attached policy, prefilled with your IDs, using the stepsecurity_developer_mdm_profile and stepsecurity_developer_mdm_ide_extension_policy resources.
3. Generate the config, review, apply: run terraform plan -generate-config-out=generated.tf, review generated.tf before committing, then apply. From that point on, changes to the profile and its policies can be managed through Terraform.