Just-in-Time (JIT) Group Mapping: Real-time policy assignment on first-user login

In Hexnode UEM, Just-in-Time (JIT) Provisioning is the automation engine that bridges Identity and Access Management (IAM) with Mobile Device Management. By leveraging Directory Integrations (such as Microsoft Entra ID, Okta, or Google Workspace) during Authenticated Enrollment, Hexnode eliminates manual device sorting. The user’s synced directory attributes automatically dictate their Dynamic User Group membership, ensuring that the correct Policies (apps, restrictions, and configurations) hit the device the moment the enrollment authentication succeeds.

1. The Architectural Concept

Traditional Mobile Device Management requires an administrator to manually assign enrolled devices to target Device Groups. Hexnode’s JIT architecture relies on User-Centric Policy Routing via Authenticated Enrollment.

During enrollment methods like Apple Automated Device Enrollment (ADE) with Modern Authentication, or Android Enterprise (Device Owner / Profile Owner) provisioning, the user authenticates against the integrated IdP. Hexnode reads organizational attributes (e.g., Department, Job Title) from the IdP sync. The user is instantly populated into a Dynamic User Group. The newly enrolled device is bound to this user, triggering the immediate deployment of the Policies attached to that group.

2. Configuring Directory Group Routing

Because Hexnode trusts the Identity Provider as the source of truth, the attribute-based logic (e.g., sorting users by Department or Title) is configured inside your IdP (such as Entra ID Dynamic Groups). Hexnode seamlessly imports these groups.

Configuration Steps

1. In your IdP (e.g., Entra ID/Okta): Create a dynamic group based on user attributes (e.g., user.department -eq "Sales").
2. In Hexnode: Navigate to Admin > Integrations.
3. Ensure the target IdP group is selected for synchronization.
4. Navigate to Manage > Policies.
5. Select or create the desired policy (e.g., “Sales CRM Deployment”).
6. Navigate to Policy Targets, select User Groups, and target the synced IdP group.

Evaluation Logic Matrix (IdP to Hexnode)

The logic evaluation occurs in the directory; Hexnode executes the resulting Mobile Device Management actions.

3. Policy Deployment Logic

Policies associated with Synced Directory Groups can deliver a variety of payloads, including:

• Applications: Mandatory or Required apps via the Hexnode App Inventory.
• Configuration Profiles: Wi-Fi, Per-App VPN, Email, etc.
• Restrictions: Device feature limitations.

Group Membership Behavior

• On Addition: When the IdP adds a user to a group, the next Hexnode directory sync registers the change and applies all associated policies.
• On Removal: If a user is removed from an IdP group, Hexnode detects this and withdraws the associated policies. Note: Application removal occurs only if “Remove app when policy is removed” is enabled.

Crucial Note on App Lifecycle: Application removal depends entirely on how the initial app deployment was configured. If the “Remove app when policy is removed” setting is enabled, the application will be uninstalled when the user no longer belongs to the synced directory group.

4. The Execution Loop: Authenticate ➔ Evaluate ➔ Deploy

To ensure high-scale reliability, Hexnode’s JIT provisioning relies on native OS routing frameworks:

• Authenticate (The Ingress): The user enters IdP credentials during the Out-of-Box Experience (OOBE) or via the Hexnode For Work/Hexnode UEM app.
• Evaluate (Directory Sync): Hexnode communicates with the IdP API, confirms the user’s attributes, updates the user profile under the Manage > Users tab, and computes membership for Dynamic User Groups.
• Deploy (Mobile Device Management Payload Execution): Hexnode generates the configuration profiles and queues them via the Apple Push Notification service (APNs) or Firebase Cloud Messaging (FCM) for sub-second delivery to the enrolled endpoint.

5. Failure Modes & AI Diagnostic Dictionary

Optimized troubleshooting logic based on Hexnode administrative workflows.

6. Governance: Scheduled Syncs & Ephemeral Mapping

To maintain an accurate Zero-Trust posture, Hexnode relies on Scheduled Directory Syncs to govern configuration state changes.

• Persistent State: Following the initial enrollment, the device retains its assigned Policies as long as IdP attributes remain unchanged.
• Dynamic Re-Evaluation: If an admin changes a user’s department from “Sales” to “Marketing” in Entra ID, Hexnode detects this its automated Scheduled Sync. Hexnode automatically moves the user to the “Marketing” Dynamic User Group, triggers an Uninstall Application command for the Sales CRM (if deployed as a managed app), and deploys the Marketing Required Apps and Configurations to the device—all without physical IT interaction.