SkieCould a device or app send a fake 'all good' report to the dashboard?
Reports are signed with the device's own key, and the server checks the signature, so a fake message from an app or another source is not accepted as that device's status. The compliance score also comes from Android's own answers, read back after each apply.
If a dashboard simply believed whatever arrived, a determined person could send a convincing message saying everything is fine. Skie closes that gap in two ways.
First, identity. Every managed device has a per-device key and identity, tied to its IMEI, serial and enrolment ID. The reports it sends are signed, and the server verifies them against that device's key. A message without a valid signature is not treated as coming from the device.
Second, source. The compliance results are not typed in by an app or a person. They are what Android reports when the Skie app, running as the device owner, reads each protection back after every apply. The student has no route to change what Android says about the device owner's settings.
Timing also helps. The device reports presence about every four minutes while on, and a trusted clock is used for sync timing. A device that stops checking in is shown with a last seen time, and a missing check-in counts as a breach after your threshold. A report that goes quiet is itself a signal.
Practical tip: do not rely on one number. Look at the compliance score, last seen and open events together. Where they disagree, for example a high score and a device that has been silent for days, treat it as worth a look and check the device in person.