Dynamic device groups

Dynamic groups automatically update their member devices based on pre-defined criteria, eliminating the need for manual group maintenance. Unlike Custom Groups, which have a fixed list, Dynamic Groups evaluate devices during periodic syncs to add or remove them as they meet or fail specific conditions.

Creating a Dynamic Device Group

Follow these steps to automate device grouping based on specific criteria and locations:

Step 1: Initiate Group Creation

1. Log in to Hexnode UEM portal.
2. Navigate to Manage > Device Groups > New Dynamic Group .

Step 2: Define Conditions and Exceptions

In this stage, define the “rules” that determine which devices are automatically added to the group.

1. Set Conditions: Under Choose Condition Filters, fill in the three required fields:
   1. Column: Select the device attribute (e.g., OS Version, Model, Platform ).
   2. Comparator: Choose the logic (e.g., Is , Is not, Greater than).
   3. Value: Enter the specific data to evaluate against.
2. Logic & Nesting: Use + New Filter for standard conditions.
   1. Use the + icon to create nested conditions for complex logic.
   2. Toggle between AND / OR to define how multiple rules interact.
3. Add Exceptions: If there are specific devices that meet the criteria but should not be in the group, configure rules under Add Exceptions using the same structure.
4. Click Next.

Step 3: Apply Geofence Filters

Further, narrow the group based on physical location. Following are the two options available:

1. Select Existing: Choose a pre-configured geofence from the list.
2. Create New: Click Add a new geofence option to directly define boundaries within this workflow.

Action: Set the geofence to either Include (only devices inside the fence) or Exclude (only devices outside the fence) and click Next.

Step 4: Preview and Finalize

1. Review the list of devices in the preview to confirm they align with the conditions and geofences configured.
2. Click Save to proceed once the preview is verified.
3. Enter a unique Group Name and Description when the pop-up prompt appears.
4. Click Save to finalize the process and create the dynamic group.

Filter Configuration Logic

Hexnode uses a three-tier filtering system to define group membership.

Geofence Filters

Use these filters to automate group membership based on the physical geographical boundaries (fences) a device enters or exits.

Existing Geofences: Select one or more locations (fences) already created under Admin > Geofencing.

Instant Creation: Click the + Create New Geofences button to add new boundaries directly from the dynamic group setup page.

Include: Applies policies to devices inside the specified regions.

Exclude: Applies policies to all devices except those in the specified regions.

Condition and Exception Filters

Condition filters allow you to specify the criteria required for grouping devices.

Exception filters allow you to define a “blocklist” within your group rules. Any conditions mentioned here will exclude the devices satisfying these conditions from the device group, even if they meet the primary criteria defined in the Condition Filters.

To configure a filter, select the Column Group, the specific Column, a Comparator (e.g., Equal to, Greater than), and the Filter Value.

The available column groups and the columns available corresponding to each of them are listed as follows,

Logical Operators (AND / OR)

Logical operators define the relationship between multiple filters, determining whether a device must meet all criteria or just a single condition to join the group.

• AND: Devices must meet all specified criteria.
• OR: Devices are added if they meet at least one criterion.
• Multiple Constraints: To add multiple conditions or exceptions, utilize the ‘+’ option provided after each entry. Conversely, to remove a condition or exception, click the ‘–’ option located next to the ‘+’ option.
• Nested Constraints (Ellipsis icon): Allows for complex logic (e.g., (Condition A AND B) OR Condition C).

Viewing and Monitoring Dynamic Device Groups

Once created, dynamic groups are listed under Manage > Device Groups and are identifiable by the “Dynamic” tag in the Group Type column. Selecting a specific group opens a comprehensive dashboard.

Dashboard Overview

The group details page provides a real-time snapshot of the following:

• Device Statistics: Total number of devices, non-compliant and inactive devices.
• Compliance info: Immediate visibility into security status across the group.
• Sync Information: The Last Sync Time showing when Hexnode last evaluated membership rules.
• Associated Policies: Total number of policies currently applied to the group.

Data Sub-Tabs

• Devices Tab: Lists every device currently meeting the group’s criteria, along with their full technical specifications.
• Policy Tab: Provides a quick overview of associated policies.

  To Add Policies: Click Associate Policy, select your desired policy, and click Associate.
  

• Locations Tab: Fetches and displays the location history of the group. If a Location Tracking policy is associated with the member devices (or the group as a whole), this tab displays a complete list and map view of all locations traversed by the member devices.
  

Editing Dynamic Device Group Rules

Because organizational needs change, Hexnode allows you to review and modify membership rules at any time.

How to Edit a Group:

1. Navigate to Manage > Device Groups.
2. Select the target Dynamic Group from the list.
3. Click on the Criteria tab.
4. Modify your Condition Filters, Exceptions, or Location (Geofence) Filters.
5. Click Save Group.

Automated Policy Application

Upon saving changes, Hexnode periodically processes the updated rules.

Auto-Sync: Devices are automatically added to or removed from the group as they satisfy the new requirements.

Dynamic Enforcement: Policies associated with the group are instantly applied to new members and removed from devices that no longer qualify.

Administrative Actions

• Manual Sync: To force an update, go to Manage > Device Groups and select Actions > Sync Dynamic Groups (for all) or Sync Now (for a specific group).
  
  
• Reporting: Select a group and click Export to download a detailed device report in PDF or CSV format.
  
• Remote Actions: Use the Actions button to send instant commands (e.g., Lock, Wipe, Scan) to the entire group.

Use Cases for Automation

• Compliance Remediation: Automatically group all “Non-compliant” devices in a specific city to perform a bulk “Disenroll” or “Lock.”
  
• OS-Specific Policies: Group all Android devices not running a specific version (e.g., Android 8) to push a mandatory update or restricted Kiosk profile.
  
• BYOD Management: Create a group where Ownership = Personal to automatically apply less-restrictive privacy policies.
  

Frequently Asked Questions (FAQs)

1. What is the difference between a Dynamic Group and a Custom (Static) Group?

   Dynamic groups use rules to update membership automatically during syncs. Custom groups require an administrator to manually add or remove devices from a fixed list.

2. How do I delete a Dynamic Group?

   Go to Manage > Device Groups, select the group, click Actions, and select Delete Group.