Configure Dynamic Device Groups

Dynamic Device Groups give Admins the ability to streamline membership of device groups using rules-based automation. The configurable rules are built on common device attributes and operators. After you've configured dynamic groups, you can scale your day-to-day tasks via groups without having to spend precious time manually managing groups.

Group membership updates are made nightly and also whenever the following events occur:

• A change is made to the group – rules or otherwise.
• A device attribute value changes.
• A new device is created.

Dynamic device groups allow Admins to:

• Save time and increase efficiency by completing group-based tasks at scale.
• Embrace a more secure just-in-time approach to granting users access to resources.
• Automate the management of software on devices.
• Improve compliance by automatically applying policies to devices at scale and quickly identifying devices that require attention.

Considerations

Enabling Dynamic Device Groups

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Device Groups.
3. Choose an existing group from the list or create a new group. See Create a Device Group to learn how to create a new device group.
4. Under the device group aside Details tab, scroll to Membership Controls.
   
5. Choose Dynamic.
6. (Optional) To require review before membership changes take effect, select Require administrator review of updates.
   • (Optional) Select Receive emails when administrator review is needed for updates to opt in to emails notifying all administrators in the organization that new group membership changes are awaiting approval.
   • See Reviewing Membership Updates below for more information.
7. Click save.

Configuring Dynamic Device Groups

Building Rules

Considerations:

• Currently, a contains operator is not supported. This is on our roadmap.
• If group-associated MDM-enrolled devices are added to a dynamic device group, those devices are subject to the dynamic rule(s) applied to that same group. Use caution when creating dynamic device groups with MDM-enrolled devices to avoid creating conflicting rule sets.
• While there is no firm limit to the number of conditions you can configure for a single rule, for best results, we have found that 3-4 conditions is usually sufficient. Adding more than 4 conditions to a rule is a sign that you should consider adjusting the query to be more specific.
• There is no validation in the rule builder, meaning that you could potentially configure rules that aren’t logical or that contradict each other. Leverage the Preview before saving the group configuration to confirm that your rules make sense.

Use the table below as a reference for the attributes, operators, and values that exist for dynamic device groups.

To create an attribute-based rule:

1. Select the Attribute from the drop-down.
2. Select an Operator.
3. Select a Value.
4. (Optional) Click + to add a second attribute value.

5. (Optional) Click Add Condition to add multiple conditions to a rule for the dynamic group.

6. Continue to the next section to add exemptions to the rule, or click save.

Using Exemptions

Under the Exemptions section, you can specify devices to include in or exclude from the dynamic group, regardless of the rules of the group. Devices added here will automatically be bound or unbound on the Devices tab.

To add a device to the inclusion or exclusion list:

1. In the Devices to Include or Devices to Exclude section, click in the Search bar.
2. Search for the device you would like to add to the list and then select the checkbox next to the device in the dropdown.
   • Devices appear in alphabetical order by Device Name (assigned under the device’s Details tab).
   • Selected devices appear as pills below the Search bar.
3. When finished adding devices, click save.

To remove a device from the inclusion or exclusion list:

1. In the Devices to Include or Devices to Exclude section, click in the Search bar.
2. Search for the device(s) you would like to remove from the list and then clear the checkbox next to the device(s) in the dropdown.
   • Alternately, click x on the pill next to the name of the device you want to remove.
3. When finished removing users, click save.

To remove a device from the Devices list:

1. In the device group aside, select the Devices tab. A list of the devices that are included in the device group is displayed.
2. Clear the checkbox next to any devices you want to exclude from the list.
3. Click Save.
4. A Membership Conflict message appears. Manual changes made to the device group by deselecting devices under the Devices tab will create an automatic exemption. Click Continue to accept.
   

Previewing Configuration

When you have finished configuring attribute-based rules and exemptions for the dynamic device group, click Preview before saving the group configuration to see a list of membership updates that will take place upon save. When you have finished reviewing, click Close, then click save to save the group.

Reviewing Membership Updates

When configuring a dynamic device group, you have the option to add a review requirement before membership changes are made.

Considerations:

• All administrators, excluding those with Read Only or Help Desk roles, will be able to review and accept or reject membership updates.
• If the option to send email notifications is selected, the emails will be sent to all applicable administrators in the organization. See Admin Portal Roles for more information.

Optional settings for membership updates include:

• Require administrator review of updates: Select this option to require that membership changes be reviewed and manually applied by the administrator.
• Receive emails when administrator review is needed for updates: This option becomes available when Require administrator review of updates is selected, but it is not selected by default. Select this option to send a nightly email notification to all administrators in the organization with a list of the group membership suggestions that need to be reviewed.
  • Click Review Suggestions to open the Review Device Group Membership modal in the Admin Portal.
    

When Require administrator review of updates is selected and membership updates are ready to review, you will see Pending changes found | Review in the Device Membership Controls column of the Device Groups list.

• Click Review to see the device group’s membership updates.
  • Note: When making configuration changes directly within a group, you must save the changes before you are able to review.
• Use the checkboxes on the select individual updates you would like to apply.
• Click Accept and Save when finished to update the group.
  

Disabling Dynamic Device Groups

When you convert a dynamic device group, the group becomes a manually controlled static group moving forward, with device membership preserved as-is in that moment.

To turn off dynamic group membership:

1. Log in to the JumpCloud Admin Portal.
2. Go to DEVICE MANAGEMENT > Device Groups.
3. Select the group for which you would like to disable group membership automation.
4. Under Membership Controls, select Static.

Applying Policies to Dynamic Device Groups

Dynamic device groups are the foundation for IT Admins to take scalable actions that increase efficiency and security across their organizations.

• Next step: Assign a Policy Group