Overview
Smart Device Groups group your devices automatically, based on conditions you set, such as operating system, OS version, or installed software. Devices join a group as soon as they meet its conditions, and leave when they no longer do. Assign policies, software, and commands to the group, and they follow the devices in it.
Benefit | What it means |
Automatic membership | Devices join and leave as they meet, or stop meeting, the group's conditions. |
Simpler administration | Deploy policies, software, and compliance rules to a whole group at once. |
Automatic cleanup | With Auto-Remove Group Policies, a group's policies are removed from devices that leave it. |
Scales with you | Combine conditions to target exactly the devices you need. |
Create a Smart Device Group
In Swif, go to Device Management > Device Groups.
Click Create Group, and select Smart Group.
Enter a Name, and an optional Description.
Set the conditions devices must meet to join the group. See Group conditions below.
Under Additional Settings, choose whether to turn on Auto-Remove Group Policies. See Remove policies automatically when devices leave below.
Choose the policies, software, and commands to assign to the group.
Click Save.
Group conditions
Use one or more of these:
Condition | Examples |
Operating system | Windows, Linux, macOS, Unix, Android, iOS, iPadOS, ChromeOS |
OS family | Debian, RedHat, Arch, SUSE, Alpine, Solaris, FreeBSD |
OS version | Less than, equal to, or greater than a version |
Device name | — |
Managed installed software | Software deployed through Swif |
User installed software | Software users installed themselves |
Installed software | Type at least 3 characters to search, then choose Installed or Not installed |
Enrollment status | — |
Ownership type | BYOD or company-owned |
Last check-in date | — |
Device inactivity | Inactive for at least a number of days |
Example groups
Group | Conditions |
Outdated Macs | OS is |
Devices missing antivirus | Installed software is Not installed: [your antivirus app] |
Company-owned Windows devices | OS is |
Remove policies automatically when devices leave
By default, when a device leaves a Smart Group, the policies it got from the group stay on the device. With Auto-Remove Group Policies on, Swif removes the group's policies from a device about 30 seconds after it leaves the group.
This keeps devices from holding on to policies they no longer need, for example after a device is moved to another department, or its OS is updated past a group's condition.
Swif never removes a policy a device still needs. A policy stays on the device if it also comes from somewhere else. See When policies are kept below.
Turn it on
Where | How |
New group | When creating a Smart Group, under Additional Settings, turn on Auto-Remove Group Policies. |
Existing group | Open the group, and turn on Auto-Remove Group Policies in its details. |
It's off by default, and available for Smart Groups only. Manual groups don't support it.
Turning it on for an existing group doesn't remove policies right away. It applies only to devices that leave the group after you turn it on.
When policies are kept
A policy stays on a device that leaves the group when:
The policy also… | Example |
Is assigned to the device directly | You assigned the policy to the device itself, not only through the group. |
Comes from another group the device is in | The device is still in another group that has the same policy. |
Came from a group with Auto-Remove off | Another group, with Auto-Remove Group Policies off, gave the device the same policy earlier. |
Was installed before Swif tracked where policies come from | To be safe, Swif keeps policies whose source it can't confirm. |
What happens in other situations
Action | Auto-Remove on | Auto-Remove off |
A device leaves the group | The group's policies are removed after about 30 seconds, unless they're kept | The policies stay on the device |
You archive the group | The group's policies are removed from its devices. If you unarchive it, membership is recalculated, and the policies are deployed again. | The policies stay on the devices |
You delete the group | The group's policies are removed from its devices, unless they're kept | The group is deleted. The policies stay on the devices. |
You remove a policy from the group | That policy is removed from the group's devices, unless it's kept | The policy is removed from the group, but stays on devices where it came from another source |
You change the group to a manual group | Turn off Auto-Remove Group Policies first, in the same change. Otherwise, the change isn't saved. | Allowed |
Every removal is recorded in the device's audit trail, including when a policy was kept because it came from another source.
Manage Smart Device Groups
Edit a group: open it, change its conditions or settings, and save.
Delete a group: select it, and click Delete. With Auto-Remove Group Policies off, devices keep the group's policies. With it on, the group's policies are removed from its devices, unless they're kept.
How assignments are retried
If a policy, software, or command assignment fails on a device, Swif retries it every 10 minutes, up to 3 times. After that, it stops retrying.
More with Smart Device Groups
Use device specs and extension attributes
Build groups from detailed hardware and OS properties, or your own custom attributes. Use them for compliance, testing, or staged rollouts. See Smart Device Groups with Device Specs and Extension Attributes.
Provision accounts automatically
Set up accounts automatically when devices join a group, so users get access to the systems they need right away. See Automate Account Provisioning by Device Group.
Sync user account permissions
Keep user permissions matched to each device's group, even as devices move between groups. See User Account Permission Sync at Device Group.
Rename devices automatically
Name devices automatically based on their group, for a consistent naming standard. See Device Name Auto-Renaming for Smart Groups.
Run commands when devices join
Run commands or scripts automatically, once, when a device joins a group. For example, install a monitoring agent as soon as a device joins a high-security group.
Where | How |
New group | In the Select Commands step, use the Run on device join column to choose which commands run automatically. |
Existing group | Go to the group's Commands tab, and change Run on device join for any command. |
Once per device, per group. If a device leaves and later joins the group again, its commands are evaluated again, based on the group's current settings.
In order. Multiple commands run in the order they're listed.
When devices move between groups, the new group's commands run when the device joins it.
Track results in the device's command history, including successes, partial failures, and errors.
FAQ
Can a device be in more than one Smart Group?
Yes. A device joins every Smart Group whose conditions it meets.
How often is Smart Group membership updated?
As devices change, for example after a check-in. For Installed software conditions, membership updates with each software inventory sync. For example, a device leaves a Not installed group as soon as the app is found.
How long does Auto-Remove take?
About 30 seconds after a device leaves the group. An offline device gets the change when it next checks in.
Will turning on Auto-Remove remove policies from devices already in the group?
No. It applies only to devices that leave the group after you turn it on.
Why wasn't a policy removed when a device left the group?
The policy also comes from somewhere else, such as a direct assignment, or another group the device is in. See When policies are kept.
Can I use Auto-Remove with manual groups?
No. It's available for Smart Groups only, since devices leave manual groups only when you remove them.
What happens to policies when I delete a Smart Group?
With Auto-Remove Group Policies off, they stay on the devices. With it on, they're removed, unless they also come from somewhere else.