> ## Documentation Index
> Fetch the complete documentation index at: https://docs.safedep.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Apply the Cloud Policy in PMG

> Turn on cloud.policy so that PMG applies the block entries, trust entries and dependency cooldown of your SafeDep Cloud tenant.

With the `cloud.policy` setting on, PMG applies the [cloud policy](https://docs.safedep.io/governance/cloud/policy/overview) of your tenant: its block entries, its trust entries and its dependency cooldown. Your security admin changes the policy in SafeDep Cloud, and PMG gets the change with no new config on each machine.

> [!NOTE]
>
> The cloud policy needs the SafeDep Cloud Team or Enterprise plan. See [pricing](https://safedep.io/pricing). Without `cloud.policy`, PMG works as before and blocks malicious packages with no account.

## Turn on the cloud policy on one machine

```bash theme={null}
pmg config set cloud.enabled true
pmg cloud login
pmg config set cloud.policy true
pmg cloud sync
```

* `pmg cloud login` stores the tenant ID and an API key of the tenant. PMG can also read them from the `SAFEDEP_TENANT_ID` and `SAFEDEP_API_KEY` environment variables.
* `cloud.policy` applies only when `cloud.enabled` is `true`.
* `pmg cloud sync` fetches the policy at once.
* `pmg config set` adds `cloud.policy` to a config file that an older PMG wrote. If the command prints `key not found`, the file has no `cloud` section. Run `pmg setup install` to add the missing keys of the PMG template to your config file, then run `pmg config set` again. You can also add the key by hand with `pmg config edit`.

Then check the state:

```bash theme={null}
pmg setup doctor
```

The cloud policy check names the tenant, the revision that PMG applied and the age of the cache. It warns when no cache exists yet, when the cache is more than 7 days old, when PMG rejected a policy, and for each field that PMG does not apply.

## Turn on the cloud policy with MDM

On an endpoint with a managed config file, users cannot change the PMG config. Set both keys in the managed config file:

```yaml theme={null}
cloud:
  enabled: true
  policy: true
```

To turn off all cloud content on a managed endpoint, set `cloud.policy: false` in the managed config file. Under `global_lockdown: true`, the cloud policy does not change a key that the managed config file sets. So keep each key that the cloud policy must manage out of that file. See [Deploy PMG with MDM](https://docs.safedep.io/package-security/pmg/mdm/overview#manage-settings-from-the-cloud-policy).

## What PMG fetches

PMG fetches the resolved policy of the endpoint. It holds the package rules that apply to the endpoint and the dependency cooldown. PMG sends the labels `reported/os` and `reported/arch` with each fetch, so a policy override can select endpoints by operating system or CPU architecture.

PMG fetches the policy in the background after each command, also after a command that PMG blocked. It fetches at most once every 5 minutes, also when `cloud.auto_sync.enabled` is `false`. `pmg cloud sync` fetches at once. The persistent proxy applies a new policy with no restart.

PMG keeps the policy in the `cloud-policy/` folder of its config folder. Under `sudo`, PMG reads the cache of the user who ran `sudo` first.

On a short-lived CI runner, run `pmg cloud sync` before the first install. A new runner has no cache, so it applies only the PMG config until the first fetch.

## Offline and failed fetches

PMG never drops the cloud policy because it is offline. It keeps the last policy that it applied until a newer one arrives.

| State | When | What PMG does |
| - | - | - |
| Applied | A fetch succeeded in the last 7 days | Applies the policy |
| Stale | No fetch succeeded for more than 7 days | Applies the last policy. `pmg setup doctor` warns. |
| Rejected | A new policy fails its check, for example it is for another machine | Keeps the previous policy. `pmg setup doctor` warns. |
| None | No cache yet | Applies only the PMG config |

A fetch that fails keeps the cache. When you log out, PMG keeps the last policy. PMG drops a trust entry at its expiry, also with no network.

## Which settings the cloud policy changes

| PMG setting | With the cloud policy |
| - | - |
| `dependency_cooldown.enabled`, `dependency_cooldown.days` | When the policy sets the cooldown, its value wins over the config file and the `PMG_*` environment variables. PMG refuses `--skip-dependency-cooldown`. PMG rounds the value up to whole days. Exception: under `global_lockdown`, a managed config file that sets one of these keys keeps its value. |
| `dependency_cooldown.skip` | Still applies. |
| `blocked_packages` | Still applies, together with the block entries of the policy. |
| `trusted_packages`, `--insecure-installation` | Still apply, but a block entry of the policy wins over them. |
| Malicious Package Exclusions of SafeDep Cloud | PMG ignores them. Use [trust entries](https://docs.safedep.io/governance/cloud/policy/trust-a-package.md) instead. |
| Every other setting, such as the sandbox and the proxy | Not changed. The cloud policy does not manage them. |

A trust entry of the policy never skips the malware analysis and never allows verified malware. See [Package Rules](https://docs.safedep.io/concepts/package-rules.md).

## What a block looks like

A block entry of the cloud policy stops the install with a message that names the rule and the revision. This example comes from the PMG tests:

```text theme={null}
pmg: blocked pkg:npm/evil@1.2.4 by the policy of your tenant
     rule r_9c1 · policy revision 48 · default policy revision 12 · IR-2291 credential stealer
     To ask for an exception, send the rule id and the reason to your security admin.
     They can run: safedep policy rule show r_9c1
```

With `cloud.enabled` on, PMG syncs each decision of the cloud policy to your tenant. Your security admin can list them with `safedep policy decision list`. See [Explain a Decision](https://docs.safedep.io/governance/cloud/policy/explain-a-decision.md).

## Known gaps

PMG keeps the policy cache in the folder of the user, so a user can change the cache on a laptop. For each gap of this release, see [Cloud Policy Limits](https://docs.safedep.io/reference/cloud-policy-limits.md#known-gaps).

## Next steps

> [card] [Cloud Policy](https://docs.safedep.io/governance/cloud/policy/overview)
>
> What the cloud policy controls and who can change it.

> [card] [Hold Back Newly Published Versions](https://docs.safedep.io/package-security/pmg/dependency-cooldown.md)
>
> The dependency cooldown of PMG.

> [card] [Deploy PMG with MDM](https://docs.safedep.io/package-security/pmg/mdm/overview)
>
> Ship the managed config file to a fleet.

> [card] [PMG configuration](https://github.com/safedep/pmg/blob/main/docs/config.md#cloud-policy)
>
> The config reference in the PMG repository.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.