Dynamic device groups

Dynamic groups automatically update their membership based on rules you define — no manual maintenance required. Unlike Custom Groups, which hold a fixed list you add to by hand, Dynamic Groups re-evaluate every device during each sync and add or remove it as it starts or stops meeting your criteria.

What this replaces: without dynamic groups, keeping a group like “all non-compliant devices” accurate means someone manually checking compliance status and moving devices in and out by hand — a process that’s stale the moment it’s finished. A dynamic group stays correct on its own: a device that becomes non-compliant joins the group automatically, and one that’s remediated leaves it automatically, with the right policy following it either way.

Creating a Dynamic Device Group

Follow these steps to automate device grouping based on specific criteria and locations:

Step 1: Initiate Group Creation

1. Log in to Hexnode UEM portal.
2. Navigate to Manage > Device Groups > New Dynamic Group .

Step 2: Define Conditions and Exceptions

In this stage, define the “rules” that determine which devices are automatically added to the group.

1. Set Conditions: Under Choose Condition Filters, define your rule using three fields:
   1. Column — the device attribute to check (e.g., OS Version, Model, Platform ).
   2. Comparator — the logic to apply (e.g., Is , Is not, Greater than).
   3. Value — what to check that attribute against.
2. Logic & Nesting: Use + New Filter to add more conditions, or the + icon to nest conditions for more complex logic.
3. Toggle AND / OR to control how multiple rules combine — AND requires every condition to match; OR requires just one.

   Why nesting matters: a flat list of conditions can only express “match all of these” or “match any of these” — it can’t express “match this AND (either of these two).” Nesting lets you build that kind of logic without creating multiple overlapping groups to fake it.

4. Add Exceptions: If there are specific devices that meet the criteria but should not be in the group, configure rules under Add Exceptions using the same structure.

   Use Add Exceptions to exclude specific devices that would otherwise match your conditions — useful for handling known edge cases (a test device, a temporarily reassigned unit) without rewriting your core group logic every time one comes up.

5. Click Next.

Step 3: Apply Geofence Filters

Further, narrow the group based on physical location. Following are the two options available:

1. Select Existing: Choose a pre-configured geofence from the list.
2. Create New: Click Add a new geofence option to directly define boundaries within this workflow.

Action: Set the geofence to either Include (only devices inside the fence) or Exclude (only devices outside the fence) and click Next.

Step 4: Preview and Finalize

1. Review the list of devices in the preview to confirm they align with the conditions and geofences configured.
2. Click Save to proceed once the preview is verified.
3. Enter a unique Group Name and Description when the pop-up prompt appears.
4. Click Save to finalize the process and create the dynamic group.

Filter Configuration Logic

Hexnode uses a three-tier filtering system to define group membership.

Geofence Filters

Dynamic groups can also filter by physical location using existing or newly created geofences:

Include — applies the group’s policies only to devices inside the specified region(s).

Exclude — applies the group’s policies to every device except those inside the specified region(s).

Why this combination is powerful: paired with a compliance or security condition, geofencing lets you build rules like “lock down any non-compliant device the moment it leaves the corporate campus” — a location-aware security response that would otherwise require a separate geofencing tool bolted onto your device management, checked and reconciled manually.

Condition and Exception Filters

Condition filters allow you to specify the criteria required for grouping devices.

Exception filters allow you to define a “blocklist” within your group rules. Any conditions mentioned here will exclude the devices satisfying these conditions from the device group, even if they meet the primary criteria defined in the Condition Filters.

To configure a filter, select the Column Group, the specific Column, a Comparator (e.g., Equal to, Greater than), and the Filter Value.

The available column groups and the columns available corresponding to each of them are listed as follows,

Logical Operators (AND / OR)

Logical operators define the relationship between multiple filters, determining whether a device must meet all criteria or just a single condition to join the group.

• AND: Devices must meet all specified criteria.
• OR: Devices are added if they meet at least one criterion.
• Multiple Constraints: To add multiple conditions or exceptions, utilize the ‘+’ option provided after each entry. Conversely, to remove a condition or exception, click the ‘–’ option located next to the ‘+’ option.
• Nested Constraints (Ellipsis icon): Allows for complex logic (e.g., (Condition A AND B) OR Condition C).

Viewing and Monitoring Dynamic Device Groups

Once created, dynamic groups are listed under Manage > Device Groups and are identifiable by the “Dynamic” tag in the Group Type column. Selecting a specific group opens a comprehensive dashboard.

Dashboard Overview

The group details page provides a real-time snapshot of the following:

• Device Statistics: Total number of devices, non-compliant and inactive devices.
• Compliance info: Immediate visibility into security status across the group.
• Sync Information: The Last Sync Time showing when Hexnode last evaluated membership rules.
• Associated Policies: Total number of policies currently applied to the group.

Data Sub-Tabs

• Devices Tab: Lists every device currently meeting the group’s criteria, along with their full technical specifications.
• Policy Tab: Provides a quick overview of associated policies.

  To Add Policies: Click Associate Policy, select your desired policy, and click Associate.
  

• Locations Tab: Fetches and displays the location history of the group. If a Location Tracking policy is associated with the member devices (or the group as a whole), this tab displays a complete list and map view of all locations traversed by the member devices.
  

Editing Dynamic Device Group Rules

Because organizational needs change, Hexnode allows you to review and modify membership rules at any time.

How to Edit a Group:

1. Navigate to Manage > Device Groups.
2. Select the target Dynamic Group from the list.
3. Click on the Criteria tab.
4. Modify your Condition Filters, Exceptions, or Location (Geofence) Filters.
5. Click Save Group.

Automated Policy Application

Upon saving changes, Hexnode periodically processes the updated rules.

Auto-Sync: Devices are automatically added to or removed from the group as they satisfy the new requirements.

A note on sync timing: dynamic groups don’t update instantly — they re-evaluate on a periodic sync. If you need a group to reflect a change immediately rather than waiting for the next scheduled sync, you can trigger it manually from Manage > Device Groups > Actions > Sync Dynamic Groups.

Dynamic Enforcement: Policies associated with the group are instantly applied to new members and removed from devices that no longer qualify.

Administrative Actions

• Manual Sync: To force an update, go to Manage > Device Groups and select Actions > Sync Dynamic Groups (for all) or Sync Now (for a specific group).
  
  
• Reporting: Select a group and click Export to download a detailed device report in PDF or CSV format.
  
• Remote Actions: Use the Actions button to send instant commands (e.g., Lock, Wipe, Scan) to the entire group.

Use Cases for Automation

• Compliance Remediation: Automatically group all “Non-compliant” devices in a specific city to perform a bulk “Disenroll” or “Lock.”
  
• OS-Specific Policies: Group all Android devices not running a specific version (e.g., Android 8) to push a mandatory update or restricted Kiosk profile.
  
• BYOD Management: Create a group where Ownership = Personal to automatically apply less-restrictive privacy policies.