Hi there! Is it possible to apply custom OS settings based on policy failure? Want to deploy a custom plist, but only to devices that are failing the policy. Thanks in advance!

Short answer: not possible today. I originally opened this: https://github.com/fleetdm/fleet/issues/22694 and it was titled as "Policy failure automation: install configuration profile". It was closed as a duplicate of this issue which may or may not have captured the spirit of the original request: https://github.com/fleetdm/fleet/issues/23402 Take a look at these and add any comments that might be relevant to your use case.