Extended Checks for Screen Lock and Antivirus
Overview
Sprinto’s enhanced integrations with supported MDMs (Mobile Device Management tools) now support automated monitoring of two additional compliance checks:
Screen lock — Verifies that devices automatically lock after a defined period of inactivity.
Antivirus — Detects the presence of recognised antivirus protection on staff devices.
This enhancement enables real-time compliance tracking and removes the need for manual evidence submissions.
This article explains how to configure your MDM (Kandji or Microsoft Intune) so Sprinto can enforce these extended checks.
Prerequisites
Before enabling extended checks, ensure that:
You have admin access to your MDM account (Kandji or Intune).
You can create or edit compliance policies or profiles in your MDM.
You can update API token permissions (Kandji) or re-integrate the account (Intune).
Configure in Kandji (macOS)
Step 1 – Configure Screen Lock
Create or edit a Passcode profile with these settings:
Require passcode — Enabled
Require Passcode After Sleep or Screen Saver Begins — Immediately
Start Screen Saver After — 15 minutes or less
Assign the Passcode profile to your Blueprints.
Step 2 – Update API Key Permissions
Ensure the API key used in Sprinto has the following Device permissions enabled:
Device Library Items
Application List
Antivirus Detection
Sprinto checks the installed applications list via Kandji’s API. A device passes if any recognised antivirus is found (e.g., Microsoft Defender, CrowdStrike, Sophos, Bitdefender, SentinelOne, McAfee, Malwarebytes, etc.).
Configure in Microsoft Intune (Windows & macOS)
Step 1 – Configure Antivirus Requirement (Windows only)
In your Intune compliance policies, set one of the following to Require:
Encryption → Antivirus field
Defender → Defender field
Step 2 – Configure Screen Lock Requirement
In Intune compliance policy:
Navigate to System security → Password.
Set Maximum minutes of inactivity before password is required to 15 minutes or less.
Apply for both Windows and macOS devices.
Step 3 – Re-integrate Intune with Sprinto
After updating compliance policies:
In Sprinto, go to Settings → Integrations → Active Integrations.
Select Microsoft Intune → Manage → Update Connection.
Re-connect to the same account so Sprinto updates the integration.
How Sprinto Tracks Antivirus
Kandji: Reads installed apps via API, flags devices without recognised antivirus.
Intune: Reads compliance status directly from your configured antivirus settings.
Next Steps
Once configuration is complete:
New monitors for Screen Lock and Antivirus appear under Staff Devices in Sprinto.
Non-compliant devices are flagged automatically.
Remediation tasks are created where required.
Compliance status updates in real time based on Kandji or Intune data.
Last updated