Policy removed from user still appears under Device Policies in HexnodeSolved

Thanks for raising this question.

When a policy is removed from a user, device group, or dynamic group, Hexnode starts processing the policy revocation for all affected devices. If the policy was associated with a large number of devices, the cleanup of policy mappings may take some time to reflect across all device views.

A policy can still appear under the device’s Policies sub-tab for either of these reasons:

1. The device still has another valid assignment path to the policy, such as another user, device group, dynamic group, or direct device association.

2. The policy was removed correctly, but the device page is showing stale policy mapping data.

Recommended checks:

– Open the policy and verify its current targets under user, device, and group associations.

– Confirm that the affected device is not part of any other group where the policy is assigned.

– For dynamic groups, verify that the device no longer matches the group criteria.

– Run a device scan and then refresh the device page.

– Check from an incognito/private browser window to rule out browser caching.

If the policy is no longer assigned through any valid path and the device no longer enforces the policy after a scan, the remaining entry is most likely a stale mapping on the device view rather than an active policy deployment.

Regards,
Mary Romero

In our case, the policy had been assigned to a large number of devices. After removing it from the user, the policy targets looked clean, but the same policy was still visible on random device pages. For the dynamic group case, the device name also did not match the group rule anymore, so I was confused about whether Hexnode was still applying the policy in the background.

If the policy has no current assignment source, it should not continue to be actively deployed just because it is visible under the device’s Policies sub-tab.

The important distinction is:

– Active assignment: The policy is still linked through a user, device, device group, dynamic group, or another valid target.

– Stale mapping: The policy association was removed, but an outdated reference is still visible in the device policy list.

For large-scale policy removals, stale mappings can remain visible if the background cleanup does not fully complete for every associated device. In such cases, the policy is no longer actively pushed, but the device page may temporarily show the older association.

If the entry remains after a device scan and browser refresh, and you have confirmed there is no valid assignment path, it should be treated as a policy mapping discrepancy. Hexnode Support can clear the residual mappings from the portal side if required.

Regards,
Mary Romero