Group Management

Organize devices into groups with hierarchical policy inheritance.

Overview

Device groups let you organize endpoints and apply policies at scale. Groups support hierarchical nesting — child groups inherit the parent's policy unless overridden.

Creating Groups

  1. Navigate to Groups
  2. Click Create Group
  3. Enter a name and optional parent group
  4. Assign a policy (or inherit from parent)

Group Hierarchy

Organization (tenant default policy)
├── Engineering (strict policy)
│   ├── Backend Team
│   └── Frontend Team (relaxed clipboard guard)
├── Sales (standard policy)
└── Executives (custom policy)

Policy Resolution

When an agent requests its policy, the server resolves it using this priority:

  1. Device-specific policy (if assigned directly)
  2. Group policy (walks up the parent chain until a policy is found)
  3. Tenant default policy

Moving Devices Between Groups

  1. Go to Devices → select the device
  2. Click Edit → change the group assignment
  3. The device will receive its new policy on the next heartbeat (within 60 seconds)

Deleting Groups

Only tenant_admin and super_admin roles can delete groups. Devices in a deleted group fall back to the tenant default policy.