A city UEM compliance policy tests compromised status for jailbreak or root. What should the administrator do with devices that fail that test?

A city UEM compliance policy tests compromised status for jailbreak or root. Mark devices that fail as non-compliant in UEM and apply a compliance action that blocks Hub applications—jailbreak is a UEM smoke alarm, not a vCenter sticky note. Adding only a vCenter custom attribute named Compromised and leaving Hub entitlements unchanged fails by concept because vCenter attributes do nothing for a compromised phone in someone’s pocket. Moving a matching virtual machine to an NSX-T quarantine segment fails because UEM jailbreak signals apply to mobile devices, not as a claim that UEM has no jailbreak signal or that NSX VM moves remediate phones. Deleting the Carbon Black Cloud sensor group so the device can no longer report fails because removing CBC grouping does not implement UEM compromised compliance or Hub app blocking. Exam caveat: jailbreak/root fails UEM compliance and should trigger compliance actions such as block Hub apps—not vCenter attributes, NSX VM quarantine-as-MDM, or CBC group deletion. Operational check: simulate or review a compromised-status failure in lab, confirm the device shows non-compliant, confirm Hub applications are blocked per action, and verify Hub entitlements are not left unchanged. Train the civic helpdesk to treat compromised compliance as high priority before re-enrollment.