Dynamic device groups

Dynamic groups automatically update their member devices based on pre-defined criteria, eliminating the need for manual group maintenance. Unlike Custom Groups, which have a fixed list, Dynamic Groups evaluate devices during periodic syncs to add or remove them as they meet or fail specific conditions.

Creating a Dynamic Device Group

To set up automated grouping, follow these steps:

1. Navigate to Manage > Device Groups > New Dynamic Group.
2. Define a Group Name and Description.
3. Apply Filters: Configure Geofences, Conditions, and Exceptions.
4. Preview: Click Preview to see which devices currently match your rules.
5. Save: Click Save Group.

Filter Configuration Logic

Hexnode uses a three-tier filtering system to define group membership.

Geofence Filters

Use these filters to automate group membership based on the physical geographical boundaries (fences) a device enters or exits.

Existing Geofences: Select one or more locations (fences) already created under Admin > Geofencing.

Instant Creation: Click the + Create New Geofences button to add new boundaries directly from the dynamic group setup page.

Include: Applies policies to devices inside the specified regions.

Exclude: Applies policies to all devices except those in the specified regions.

Condition and Exception Filters

Condition filters allow you to specify the criteria required for grouping devices.

Exception filters allow you to define a “blocklist” within your group rules. Any conditions mentioned here will exclude the devices satisfying these conditions from the device group, even if they meet the primary criteria defined in the Condition Filters.

To configure a filter, select the Column Group, the specific Column, a Comparator (e.g., Equal to, Greater than), and the Filter Value.



The available column groups and the columns available corresponding to each of them are listed as follows,

Column group	Column
Device info	Agent/MDM profile Apple DEP Asset tag Available internal storage Battery level (%) Department Enrollment status Encryption status Friendly name IMEI 1 IMEI 2 Kiosk mode Location tracking Lost mode Manufacturer (Windows) MEID Model Model identifier (iOS)/ Manufacturer (Android) Name Ownership Platform Self-enrollment Serial number Supervision Total internal storage UDID Used internal storage Custom attribute
User info	Alternate email Department (AD user) Domain name Domain type Email Office location (AD user) Phone number Title (AD user) User group name User type Username
Network info	Bluetooth address Carrier settings version (iOS) Current carrier network Current MCC Current MNC ICCID iOS personal hotspot Network type Phone number SIM carrier network Subscriber carrier network (iOS) Subscriber MCC Subscriber MNC Wi-Fi IP Address Wi-Fi MAC address Wi-Fi SSID Private IP Address Public IP Address
Operating system	OS name OS version
Compliance info	Blocklisted apps count Compliance status Device status Jailbroken Missing apps count Missing profile count (iOS) Password compliance Rooted
Hexnode UEM app (iOS & Android)	Version

Logical Operators (AND / OR)

Logical operators define the relationship between multiple filters, determining whether a device must meet all criteria or just a single condition to join the group.

• AND: Devices must meet all specified criteria.
• OR: Devices are added if they meet at least one criterion.
• Multiple Constraints: To add multiple conditions or exceptions, utilize the ‘+’ option provided after each entry. Conversely, to remove a condition or exception, click the ‘–’ option located next to the ‘+’ option.
• Nested Constraints (Ellipsis icon): Allows for complex logic (e.g., (Condition A AND B) OR Condition C).

Viewing and Monitoring Dynamic Device Groups

Once created, dynamic groups are listed under Manage > Device Groups and are identifiable by the “Dynamic” tag in the Group Type column. Selecting a specific group opens a comprehensive dashboard.

Dashboard Overview

The group details page provides a real-time snapshot of the following:

• Device Statistics: Total number of devices, non-compliant and inactive devices.
• Compliance info: Immediate visibility into security status across the group.
• Sync Information: The Last Sync Time showing when Hexnode last evaluated membership rules.
• Associated Policies: Total number of policies currently applied to the group.

Data Sub-Tabs

• Devices Tab: Lists every device currently meeting the group’s criteria, along with their full technical specifications.
• Policy Tab: Provides a quick overview of associated policies.

  To Add Policies: Click Associate Policy, select your desired policy, and click Associate.
  

• Locations Tab: Fetches and displays the location history of the group. If a Location Tracking policy is associated with the member devices (or the group as a whole), this tab displays a complete list and map view of all locations traversed by the member devices.
  

Editing Dynamic Device Group Rules

Because organizational needs change, Hexnode allows you to review and modify membership rules at any time.

How to Edit a Group:

1. Navigate to Manage > Device Groups.
2. Select the target Dynamic Group from the list.
3. Click on the Criteria tab.
4. Modify your Condition Filters, Exceptions, or Location (Geofence) Filters.
5. Click Save Group.

Automated Policy Application

Upon saving changes, Hexnode periodically processes the updated rules.

Auto-Sync: Devices are automatically added to or removed from the group as they satisfy the new requirements.

Dynamic Enforcement: Policies associated with the group are instantly applied to new members and removed from devices that no longer qualify.

Administrative Actions

• Manual Sync: To force an update, go to Manage > Device Groups and select Actions > Sync Dynamic Groups (for all) or Sync Now (for a specific group).
  
  
• Reporting: Select a group and click Export to download a detailed device report in PDF or CSV format.
  
• Remote Actions: Use the Actions button to send instant commands (e.g., Lock, Wipe, Scan) to the entire group.

Use Cases for Automation

• Compliance Remediation: Automatically group all “Non-compliant” devices in a specific city to perform a bulk “Disenroll” or “Lock.”
  
• OS-Specific Policies: Group all Android devices not running a specific version (e.g., Android 8) to push a mandatory update or restricted Kiosk profile.
  
• BYOD Management: Create a group where Ownership = Personal to automatically apply less-restrictive privacy policies.
  

Frequently Asked Questions (FAQs)

1. What is the difference between a Dynamic Group and a Custom (Static) Group?

   Dynamic groups use rules to update membership automatically during syncs. Custom groups require an administrator to manually add or remove devices from a fixed list.

2. How do I delete a Dynamic Group?

   Go to Manage > Device Groups, select the group, click Actions, and select Delete Group.