Skip to main content
Use a trust entry when your team reviewed a package and decided that a verdict is wrong for your tenant. A trust entry waives the verdicts of its scopes for one package until it expires. It replaces Malicious Package Exclusions.
This guide needs the SafeDep Cloud Team or Enterprise plan and the Admin role. See pricing.

​
Create the trust entry

  • The selector names one package. Add a version in the PURL, or a range with --vers, to trust only some versions. A trust entry cannot use a prefix.
  • --scope names the verdicts to waive. Give it more than once, or use all. See Choose the scope.
  • --expires is required. It takes a duration, as 30d, or a date, as 2027-01-26. The expiry is at most 90 days from now.
  • --reason is required.
The command warns that the rule loosens the policy, creates the rule and publishes a new policy revision. Every Owner and Admin of the tenant gets an email about it.

​
Choose the scope

Choose the narrowest scope. --scope all expands to the scopes that exist now. A scope that a later release adds does not apply to this rule. A trust entry never waives a verdict of verified malware, whatever its scope. A trust entry also never skips the malware analysis. If a block entry selects the same package, the block entry wins.

​
Extend or end the trust

To extend the trust entry, give a new expiry. A later expiry loosens the policy:
To list the trust entries that expire soon:
To end the trust now, delete the rule. The delete tightens the policy:
An expired trust entry no longer applies. PMG drops it at its expiry also when the endpoint is offline.

​
Move from Malicious Package Exclusions

Trust entries with the scope malware replace Malicious Package Exclusions. SafeDep Cloud does not copy exclusions into the cloud policy. For each exclusion that you still need, create a trust entry: PMG with cloud.policy on ignores the exclusions and applies only the trust entries.

​
Next steps

Package Rules

Trust scopes and the verified malware guard.

Explain a Decision

List the installs that a trust entry allowed.

Malicious Package

How SafeDep classifies a package as malicious.

Command Reference

Every flag of safedep policy rule.