Smart Groups

Smart groups are customizable groups within Workspace ONE UEM powered by AirWatch that determine which platforms, devices, and users receive an assigned application, book, compliance policy, device profile, or provision.

When you create organization groups, you typically base them on the internal corporate structure: geographical location, business unit, and department. For example, “Corporate Sales,” “Asia” With smart groups, you can deliver content and settings by device platform, model, operating system, device tag, or user group. You can even deliver content to individual users across multiple organization groups.

You can create smart groups when you upload content and define settings. However, you can create them at any time and assign them later.

The main benefit of smart groups is their reusability. Making a new assignment each time you add content or define a profile or policy might be intuitive, however, if you instead define assignees to smart groups only once, you can include those smart groups in your definition of content.

Smart Group List View

View the entire list of smart groups by navigating to Groups & Settings > Groups > Assignment Groups. Admin can only see groups which they can manage based on their permissions settings.

You can view detailed information by selecting the links within the columns Groups, Assignments, Exclusions, and Devices.

• Selecting links in the Assignments or Exclusions columns display the View Smart Group Assignments screen.
• Selecting a link in the Devices column displays the Devices > List View showing only those devices included in the smart group.
• You can Filter your collection of groups by Group Type (Smart, Organization, User, or all) or by Assigned status. Assigned status shows whether the group is assigned, is excluded, both, or neither.
• You can Assign a smart group directly from the listing.

Migrating Smart Groups

In order to prepare for the new tenancy rules surrounding smart groups, you must migrate all the affected smart groups in your environment. The new rule states that smart groups can only be managed from “customer” type organization groups or a customer type OG must exist above the smart group in the same tree. So if your environment has smart groups in global or any other organization group (OG) that lacks a “customer” type OG above it, then that smart group must be migrated.

While the migration process is entirely customer-driven, this migration process is not optional. If you have smart groups in non-customer type OGs or a smart group in a position with no customer type OG above it, then you must undergo the migration process.

It is important to note that the object being migrated is the smart group itself, not the devices to which they are assigned. Only the smart group is being migrated. The individual devices retain the same “managed by” OG as they did before the migration.

How to Migrate Your Smart Groups

Take the following steps to migrate your smart groups. This is a one time procedure.

1. Navigate to Devices > List View. If you see this banner, select Learn more to proceed with the migration.

   

   When you select “Learn more,” you will see this Smart Group Migration screen.

   

2. Close the Smart Group Migration screen. The Assignment Groups page displays.

   

3. Under Tenancy Correction Category, select “Some Devices, Some Assignments”.

   Only smart groups with both devices and assignments must be migrated.

   Smart groups that have either no devices OR no assignments need not be migrated. Migrated smart groups of these sorts have no impact to the resource assignments and should be deleted. You can delete these migrated smart groups by selecting each smart group in this category and then selecting the delete button.

4. Select the smart group that you want to migrate by clicking the check box to the left of the listing.

5. Select the Migrate Smart Group button. A Migrate Smart Group confirmation popup displays, showing how many new groups must be created in order to fully migrate the smart group.

   You can migrate only one smart group at a time.

6. Select Continue to proceed. The migration process runs its course. If the migration encounters an error, the confirmation shows this error and gives you an opportunity to Retry. Otherwise, the confirmation displays the results of a successful migration, including showing the original smart group is marked for deletion in 24 hours.

7. Select the Done button to close the confirmation.
8. Repeat steps 4-7 until all pending smart groups with devices and assignments are migrated.

Review the following scenarios to see exactly how the migration process affects your impacted smart groups.

Smart Groups at Global OG

If you have smart groups in global, then the migration process looks at each device to which the smart group is assigned. It then searches for the customer type OG child closest to global (and at the same time is a parent OG positioned above these devices), creates a smart group in that OG, and then makes devices a part of the new smart group. The original smart group is marked for deletion and removed automatically in 24 hours.

Any devices to which the smart group is assigned that are managed by an OG in another tree branch, then a second smart group is created and managed by the top-most customer type OG closest to global but that which is positioned above these remaining devices.

This process is repeated as many times, producing as many smart groups as is needed, to make sure every device in the original smart group is represented and yet retains the same content assignments as before the migration. This may mean your original smart group gets split a dozen times or more in order to 1) ensure the same content is delivered to devices while 2) ensuring smart groups are now in or under “customer” type OGs.

Smart Groups at Partner OG

In this scenario, smart groups at partner type OGs are similarly split among multiple customer type OGs using the same logic as before. A new smart group is made only when the OG positioned above devices to which the smart group is assigned is a customer type OG. If one or more devices that are a part of the smart group are found in another tree branch, then a smart group will be created and positioned in the customer OG above those devices. The original smart group is marked for deletion and removed automatically in 24 hours.

Please note that in this scenario, “SG B,” which was managed by a container OG with a single child customer OG before migration, is moved to the child customer OG after migration but its data remains untouched. This data is not altered by the migration because the devices and assignments for SG B are identical before and after migration due to the fact that there was only one customer child under its original position.

Smart Groups at Global with Partner OG

In this scenario, a single smart group at global is split across multiple trees because a partner OG and container OG stand between global and other customer OGs. The original smart group is marked for deletion and removed automatically in 24 hours.

Unassign a Smart Group

You can unassign a smart group from an application, book, policy, profile, or product. This action removes the associated content from all devices in the smart group.

1. To unassign smart groups from applications, books, compliance policies, device profiles, or product provisions. Follow the navigation paths shown.
   • Native Apps – Navigate to Resources > Apps > Native and select the Internal, Public, or Purchased tab.
   • Books – Navigate to Resources > Books > List View and select the Internal, Public, or Purchased tab.
   • Compliance Policy – Navigate to Devices > Compliance Policies > List View.
   • Device Profile – Navigate to Resources > Profiles & Baselines > Profiles.
   • Product Provision – Navigate to Devices > Provisioning > Product List View.
   • Scripts – Navigate to Resources > Scripts.
   • Sensors – Navigate to Resources > Sensors.
   • Time Windows – Navigate to Resources > Time Windows.
2. Locate the content or setting from the listing and select the Edit icon from the actions menu. Alternatively, you might select a check box or radio button to the left of the listing.
3. Select the Assignment tab or locate the Smart Groups text box.
4. Select Delete (X) next to the smart group that you want to unassign. This action does not delete the smart group. It simply removes the smart group assignment from the saved setting.
5. Follow the required steps to Save your changes.

Delete a Smart Group

When you have no further use for a smart group, you can delete it. You can only delete one smart group at a time. Selecting more than one smart group causes the Delete button to be unavailable.

Before you can delete a smart group, it cannot be assigned to any device product. If you are certain the smart group you want to delete is unassigned, then take the following steps.

1. Navigate to Groups & Settings > Groups > Assignment Groups and locate the smart group you want to delete from the listing.
2. Select the check box to the left of the smart group you want to delete.
3. Select Delete from the actions menu that displays.

Results: The unassigned smart group has been removed.

Edit a Smart Group

You can edit an established smart group. Any edits that you apply to a smart group affects all policies and profiles to which that smart group is assigned.

Here is an example of a typical need to edit a smart group. Assume a smart group for executives is assigned to a compliance policy, device profile, and two internal apps. If you want to exclude some of the executives from one or more of the assigned content items, then simply edit the smart group by specifying Exclusions. This action prevents not only the two internal apps from being installed on the excluded executives’ devices but also the compliance policy and device profile.

1. Navigate to Groups & Settings > Groups > Assignment Groups.
2. Select the Edit icon () located to the left of the listed smart group that you want to edit. You can also select the smart group name in the Group column. The Edit Smart Group page displays with its existing settings.
3. In the Edit Smart Group page, alter Criteria or Devices and Users (depending upon which type the smart group was saved with) and then select Next.
4. In the View Assignments page, you can review which profiles, apps, books, provisions, and policies can be added or removed from the devices as a result
5. Select Publish to save your smart group edits. All profiles, apps, books, provisions, and policies tied to this smart group update their device assignments based on this edit.

Results: The Console Event logger tracks changes made to smart groups, including the author of changes, devices added, and devices removed.

Research Smart Group Events Using Console Event Logger

You can track the changes to smart groups, and when they are made and by whom, by using the Console Event logger. Such tracking can be useful when troubleshooting devices.

1. Navigate to Monitor > Reports & Analytics > Events > Console Events.
2. Select Smart Groups from the Module drop-down filter at the top of the Console Event listing.
3. Apply more filters as you might require including Date Range, Severity, and Category.
4. Where applicable, select the hypertext link in the Event Data column which contains extra detail that can assist your research efforts.

Create a Smart Group

Before you can assign a smart group to an application, book, compliance policy, device profile, or product provision, you must create a smart group.

Click this link to watch a video for five best practice tips on making smart groups.

How to Make a Smart Group, Smartly (Right-click and select Open Link in New Tab)

• You can follow along with the prescriptive task companion, How To Make A Smart Group Smartly, Companion Task to the Video, which you can review as you watch the video. This companion task can be found on this topic in a section below.

• Select the applicable Organization Group (OG) to which your new smart group applies and from which it can be managed. Selecting an OG is optional.

• Navigate to Groups & Settings > Groups > Assignment Groups and then select Add Smart Group.
• Enter a Name for the smart group.
• Optionally, you can enable the Device Preview to see which devices are included in the smart group you have designed. This device preview is deactivated by default to improve performance.

• Configure the smart group type.

  Choose from:

  • Criteria – The Criteria option works best for groups with large numbers of devices (more than 500) that receive general updates. This method works best because the inherent details of these groups can reach all endpoints of your mobile fleet.

  • Devices or Users – The Devices or Users option works best for groups with smaller numbers of devices (500 or fewer) that receive sporadic, although important, updates. This method works best because of the granular level at which you can select group members.

    Note: Switching between Criteria and Devices or Users erases any entries and selections you might have made.

  • In the Criteria type, select qualifying parameters to add in the smart group. If no selection is made in any setting, then that filtering is not applied toward the criteria.

  Setting	Description
  Organization Group	This criteria option filters devices by organization groups selected. You can select more than one OG.You must select a Customer type OG or a child OG with a Customer type parent OG. Assigning the smart group to a non-customer type OG is not allowed. For more information, see the sections Changing Organization Groups and Create Organization Groups in Organization Groups
  User Group	This criteria option filters devices by user groups selected. You can select more than one user group.
  Ownership	This criteria option filters devices by ownership type selected.
  Tags	This criteria option filters devices according to device tags. You can select more than one tag.
  Platform and Operating System	This criteria option filters devices by platform and OS selected. You can select multiple combinations of each. While Platform is a criterion within a smart group, the platform configured in the device profile or compliance policy always takes precedence over the smart group’s platform. For instance, if you make an iOS device profile and assign it to a smart group, the profile is only assigned to iOS devices even if the smart group includes Android devices.
  OEM & Model	This criteria option applies only to Android and Windows Desktop platform selections made in Platform and Operating System. You can select one or more original equipment manufacturers and multiple models per OEM. New Android OEMs and models get added to the drop-down menu when devices are enrolled or synced.
  Model (Legacy)	This criteria option filters non Android and non Windows Desktop devices by model. Individual models displayed are based on the selections made in Platform and Operating System. Select from the list of presented models to include in your smart group.
  Enterprise OEM Version	This criteria option filters devices by enterprise original equipment manufacturer version. You can select more than one Enterprise OEM version. An Enterprise OEM version is a software-based classification applicable to OEM device models. For example, an Enterprise OEM version can be supplementary software support for devices such as Motorola’s Mobility Extensions (MX) or Samsung SAFE. An Enterprise OEM version can also be an OEM’s particular flavor of the Android operating system such as those offered by Honeywell, LG, and Sony among others.
  Management Type	Filter devices according to the way the device is managed.
  Enrollment Category	Filter devices according to the way the device is enrolled.
  Additions	This criteria option adds individual devices and users that are not included in the filtering criteria. You can select more than one device and more than one user.
  Exclusions	This criteria option excludes individual devices, individual users, and user groups that are included in the filtering criteria. You can exclude more than one device, more than one user, and more than one user group.

  1. Use the Devices or Users type to assign content and settings to special cases outside of the general enterprise mobility criteria. Enter the device friendly name in Devices and user name (first name or last name) in Users. You must Add at least one device or user or you cannot save the smart group.

  Setting	Description
  Devices	Add a device to this Smart Group by entering the device friendly name. You can add more than one device using this method.
  Users	Add users to this smart group by entering the user name, first name, or last name. You can add more than one user using this method.

Create and Assign a Smart Group

You can create a smart group defined by platform, ownership, user group, OS version, model, device tag, enterprise OEM, and even individual devices by friendly name.

For example, you can make a smart group containing all employee-owned iPhone Touch devices with iOS version earlier than 9.0.2. Add to this same smart group all Android devices by HTC version 2.0 with OS version 4.1 or greater. Out of this group, you can exclude devices in the user group “full time.” To this highly customized pool of *devices, you can assign 10 device profiles, 10 applications, or a compliance policy.

*Some restrictions might apply due to the multiplatform nature of this customized device pool. For example, there might be apps you want to assign that do not offer an Android version.

You can assign a smart group two ways.

Assign Smart Group While Creating Device Product

You can assign a smart group when you add or create an application, book, compliance policy, device profile, or product provision.

1. Complete the Assigned Groups drop-down menu.
2. Select a smart group from the drop-down menu. Smart groups available are managed only within the organization group (OG) to which the resource is being added, or to a child OG below it.
3. If no smart group matches the desired assignment criteria, then select the Create a Smart Group option. You can assign more than one smart group per application, book, compliance policy, device profile, or product provision.
4. Select Save to include the assignment.

Assign Smart Group While Managing the Smart Group

You can also assign a smart group during the process of managing the smart group itself.

1. View the entire list of smart groups by navigating to Groups & Settings > Groups > Assignment Groups.
2. Select one or more smart groups you want to assign and select Assign. The Assign page displays. Select the Groups link at the top of the Assign page to display the Groups page. On this page, the organization groups that manage the smart groups are displayed. Return to the Assign page by selecting the Close button.
3. On the Assign page, use the search box to view the list of eligible products and assign it to the selected smart groups.
4. Select Next to display the View Device Assignment page and confirm the assignment status.
5. Select Save & Publish.

Exclude Groups in Profiles and Policies

You can exclude groups from the assignment of device profiles and compliance policies with as much ease as assigning groups to these device products.

You must have the groups defined before you initiate this task. At a minimum, you must be able to make a smart group comprised of the users you want to exclude. This task allows you to make a new smart group on the fly but if you prefer to exclude an organization group or user group, then see the section titled Create Organization Groups in Organization Groups and User Groups respectively.

1. While adding a device profile or compliance policy, select Yes next to the Exclusions setting to display the Excluded Groups option.
2. In the Excluded Groups setting, select groups that you want to exclude from the assignment of this profile or policy.
   • You can enter the first few letters of the group by name and the auto-search function shows you all the groups whose name corresponds to the string you entered.
   • You can select one or more organization groups, user groups, or smart groups.
   • You can make a new smart group by selecting the Create Smart Group button.

3. Select Save and Publish (for device profiles) or Next (for compliance policies) and continue the process for those tasks.

   If you select the same group in both the Assigned Groups and Excluded Groups settings, then the profile or policy fails to save.

Next Steps: Preview the affected devices by selecting View Device Assignment.

How To Make A Smart Group Smartly, Companion Task to the Video

This is a companion task to the video of the same name.

How to Make a Smart Group, Smartly (Right-click and select Open Link in New Tab)

In one tab of your browser, you can have the video play, pausing as necessary, and in another tab, scroll through this task which includes all the details left out of the video.

1. Move to the Organization Group You Want to Manage the Smart Group From

Content packages such as device profiles, compliance policies, apps, books, and so on, are created from and managed by a specific organization group (OG), same as devices. You are able to include these content packages in a smart group only if you create the smart group from the same OG the content packages were created from.

Use the OG selector to move to the child OG that contains the content packages (apps, books, device profiles, compliance policies, and so on) you want to include in the smart group. You can identify the managed OG for any content package. Select the content package from its List View and then review the selected Managed By option.

For example, if you want to assign a device profile to your smart group, navigate to Resources > Profiles & Baselines > Profiles, locate the name of the device profile you want to assign to your smart group from the listing and see the Managed By column for that profile. This is the OG you move to before you make your smart group.

Note that you still have access to content created in all parent OGs above the OG you move to. This means you can assign content to the smart group from the OG you are in and also from all parent OGs above.

2. Create the Smart Group

Once you are in the organization group that contains your targeted content packages, proceed with making the smart group.

1. Navigate to Groups & Settings > Groups > Assignment Groups.
2. Select the Add Smart Group button. The Create New Smart Group screen displays.
3. Name the smart group like a newspaper headline, a summary of its contents. Naming your smart group in a way that describes the devices themselves makes it possible to assign content to the same smart group any time in the future.
   • Be warned that if you give a functional name to the smart group instead of a name that represents the devices themselves, you are more likely to create additional smart groups in the future representing the same set of devices for each new function. This is very wasteful and very taxing on the Workspace ONE UEM console.
     • For example…
     • …if you maintain a single smart group for “Non-Exempt Staff” containing 2500 devices, you can simply assign and unassign content packages as needed throughout your fleet’s lifetime. Those 2500 devices can all be served from the same smart group indefinitely.
     • Compare this streamlined practice with having multiple, functionally-named smart groups, each containing the same 2500 devices, each with different content assigned to it. Workspace ONE UEM console must spend an excessive amount of CPU cycles in order to keep track of all those smart groups and all the content assigned to each of them, slowing everything else down.
     • The time to create a new smart group is when you identify a subset of those 2500 devices that need to be treated differently than the others, for instance, different apps, differnet policies, different profiles. But even then, name that new smart group in a way that represents the devices themselves, not in a way that describes what you plan to do with them.
4. Select the right Type of Smart Group. Most of the time, the type you want is Criteria, which offers the greatest flexibility and customization. Only in specific scenarios, such as the training scenario cited in the video, does Devices and Users make more sense.
5. Select the best Criteria. Hover the mouse pointer over the info badge of each criteria category and you can see a popup describing how the category filters your device fleet.
6. Select Additions and Exclusions. As stated in the video, these two criteria categories offer the greatest freedom, even if the added or excluded device goes against every other category you previously defined.
   • For example, if you want only Apple iPhones in your smart group, even specifying a version number for iOS, you can defy this rule in the Additions category by adding iPad users and even macOS devices, provided the content assigned is compatible with both iOS and macOS.
   • Another example, if you make a smart group that contains devices for all your managers, assigning all manager-only profiles, policies, and apps, you have the freedom to include a device used by a management trainee, for example, preparing them for their new role. Conversely, you can make an Exclusion of a device in the manager pool, making the manager profiles, policies, and apps unavailable to that device. The possibilities are numerous.

3. Assign the Smart Group

There are 2 different scenarios when to assign smart groups.

1. Assign the smart group directly after making it.
   1. Navigate to Groups & Settings > Groups > Assignment Groups
   2. Locate and select the smart group you just made by inserting a check in the check box to the left of the listing.
   3. Select the Assign button. The Assign screen displays.
   4. Select profiles and policies from the available list, which is based on the organization group you are currently in. The only device profiles and compliance policies available to select are 1) those created in the organization group you are currently in and 2) those created in the same OG as the smart group you selected.
2. Assign the smart group directly after making the content package. This includes not only device profiles and compliance policies but also apps, books, products, scripts, sensors, and time windows.
   1. Navigate to the list view for the content type to which you want to assign the smart group.
      • Native Apps – Navigate to Resources > Apps > Native and select the Public, or Internal tab.
      • Books – Navigate to Resources > Books > List View and select the Internal, Public, or Purchased tab.
      • Compliance Policy – Navigate to Devices > Compliance Policies > List View.
      • Device Profile – Navigate to Resources > Profiles & Baselines > Profiles.
      • Product Provision – Navigate to Devices > Provisioning > Product List View.
      • Scripts – Navigate to Resources > Scripts.
      • Sensors – Navigate to Resources > Sensors.
      • Time Windows – Navigate to Resources > Time Windows.
   2. Locate the content or setting from the listing and select the Edit icon from the actions menu. Alternatively, you might select a check box or radio button to the left of the listing.
   3. Select the Assign button or Assignment tab, depending upon the design of the screen. Locate and click the Smart Groups text box, then select the smart group from the drop down menu that displays.