Smart groups are customizable groups within Workspace ONE UEM powered by AirWatch that determine which platforms, devices, and users receive an assigned application, book, compliance policy, device profile, or provision.
When you create organization groups, you typically base them on the internal corporate structure: geographical location, business unit, and department. For example, “Corporate Sales,” “Asia” With smart groups, you can deliver content and settings by device platform, model, operating system, device tag, or user group. You can even deliver content to individual users across multiple organization groups.
You can create smart groups when you upload content and define settings. However, you can create them at any time and assign them later.
The main benefit of smart groups is their reusability. Making a new assignment each time you add content or define a profile or policy might be intuitive, however, if you instead define assignees to smart groups only once, you can include those smart groups in your definition of content.
View the entire list of smart groups by navigating to Groups & Settings > Groups > Assignment Groups. Admin can only see groups which they can manage based on their permissions settings.
You can view detailed information by selecting the links within the columns Groups, Assignments, Exclusions, and Devices.
In order to prepare for the new tenancy rules surrounding smart groups, you must migrate all the affected smart groups in your environment. The new rule states that smart groups can only be managed from “customer” type organization groups or a customer type OG must exist above the smart group in the same tree. So if your environment has smart groups in global or any other organization group (OG) that lacks a “customer” type OG above it, then that smart group must be migrated.
While the migration process is entirely customer-driven, this migration process is not optional. If you have smart groups in non-customer type OGs or a smart group in a position with no customer type OG above it, then you must undergo the migration process.
It is important to note that the object being migrated is the smart group itself, not the devices to which they are assigned. Only the smart group is being migrated. The individual devices retain the same “managed by” OG as they did before the migration.
Take the following steps to migrate your smart groups. This is a one time procedure.
Navigate to Devices > List View. If you see this banner, select Learn more to proceed with the migration.
When you select “Learn more,” you will see this Smart Group Migration screen.
Close the Smart Group Migration screen. The Assignment Groups page displays.
Under Tenancy Correction Category, select “Some Devices, Some Assignments”.
Only smart groups with both devices and assignments must be migrated.
Smart groups that have either no devices OR no assignments need not be migrated. Migrated smart groups of these sorts have no impact to the resource assignments and should be deleted. You can delete these migrated smart groups by selecting each smart group in this category and then selecting the delete button.
Select the smart group that you want to migrate by clicking the check box to the left of the listing.
Select the Migrate Smart Group button. A Migrate Smart Group confirmation popup displays, showing how many new groups must be created in order to fully migrate the smart group.
You can migrate only one smart group at a time.
Select Continue to proceed. The migration process runs its course. If the migration encounters an error, the confirmation shows this error and gives you an opportunity to Retry. Otherwise, the confirmation displays the results of a successful migration, including showing the original smart group is marked for deletion in 24 hours.
Review the following scenarios to see exactly how the migration process affects your impacted smart groups.
If you have smart groups in global, then the migration process looks at each device to which the smart group is assigned. It then searches for the customer type OG child closest to global (and at the same time is a parent OG positioned above these devices), creates a smart group in that OG, and then makes devices a part of the new smart group. The original smart group is marked for deletion and removed automatically in 24 hours.
Any devices to which the smart group is assigned that are managed by an OG in another tree branch, then a second smart group is created and managed by the top-most customer type OG closest to global but that which is positioned above these remaining devices.
This process is repeated as many times, producing as many smart groups as is needed, to make sure every device in the original smart group is represented and yet retains the same content assignments as before the migration. This may mean your original smart group gets split a dozen times or more in order to 1) ensure the same content is delivered to devices while 2) ensuring smart groups are now in or under “customer” type OGs.
In this scenario, smart groups at partner type OGs are similarly split among multiple customer type OGs using the same logic as before. A new smart group is made only when the OG positioned above devices to which the smart group is assigned is a customer type OG. If one or more devices that are a part of the smart group are found in another tree branch, then a smart group will be created and positioned in the customer OG above those devices. The original smart group is marked for deletion and removed automatically in 24 hours.
Please note that in this scenario, “SG B,” which was managed by a container OG with a single child customer OG before migration, is moved to the child customer OG after migration but its data remains untouched. This data is not altered by the migration because the devices and assignments for SG B are identical before and after migration due to the fact that there was only one customer child under its original position.
In this scenario, a single smart group at global is split across multiple trees because a partner OG and container OG stand between global and other customer OGs. The original smart group is marked for deletion and removed automatically in 24 hours.
You can unassign a smart group from an application, book, policy, profile, or product. This action removes the associated content from all devices in the smart group.
When you have no further use for a smart group, you can delete it. You can only delete one smart group at a time. Selecting more than one smart group causes the Delete button to be unavailable.
Before you can delete a smart group, it cannot be assigned to any device product. If you are certain the smart group you want to delete is unassigned, then take the following steps.
Results: The unassigned smart group has been removed.
You can edit an established smart group. Any edits that you apply to a smart group affects all policies and profiles to which that smart group is assigned.
Here is an example of a typical need to edit a smart group. Assume a smart group for executives is assigned to a compliance policy, device profile, and two internal apps. If you want to exclude some of the executives from one or more of the assigned content items, then simply edit the smart group by specifying Exclusions. This action prevents not only the two internal apps from being installed on the excluded executives’ devices but also the compliance policy and device profile.
Results: The Console Event logger tracks changes made to smart groups, including the author of changes, devices added, and devices removed.
You can track the changes to smart groups, and when they are made and by whom, by using the Console Event logger. Such tracking can be useful when troubleshooting devices.
Before you can assign a smart group to an application, book, compliance policy, device profile, or product provision, you must create a smart group.
Click this link to watch a video for five best practice tips on making smart groups.
How to Make a Smart Group, Smartly (Right-click and select Open Link in New Tab)
You can follow along with the prescriptive task companion, How To Make A Smart Group Smartly, Companion Task to the Video, which you can review as you watch the video. This companion task can be found on this topic in a section below.
Select the applicable Organization Group (OG) to which your new smart group applies and from which it can be managed. Selecting an OG is optional.
Configure the smart group type.
Devices or Users – The Devices or Users option works best for groups with smaller numbers of devices (500 or fewer) that receive sporadic, although important, updates. This method works best because of the granular level at which you can select group members.
Note: Switching between Criteria and Devices or Users erases any entries and selections you might have made.
In the Criteria type, select qualifying parameters to add in the smart group. If no selection is made in any setting, then that filtering is not applied toward the criteria.
|Organization Group||This criteria option filters devices by organization groups selected. You can select more than one OG.You must select a Customer type OG or a child OG with a Customer type parent OG. Assigning the smart group to a non-customer type OG is not allowed. For more information, see the sections Changing Organization Groups and Create Organization Groups in Organization Groups|
|User Group||This criteria option filters devices by user groups selected. You can select more than one user group.|
|Ownership||This criteria option filters devices by ownership type selected.|
|Tags||This criteria option filters devices according to device tags. You can select more than one tag.|
|Platform and Operating System||This criteria option filters devices by platform and OS selected. You can select multiple combinations of each.
While Platform is a criterion within a smart group, the platform configured in the device profile or compliance policy always takes precedence over the smart group’s platform. For instance, if you make an iOS device profile and assign it to a smart group, the profile is only assigned to iOS devices even if the smart group includes Android devices.
|OEM & Model||This criteria option applies only to Android and Windows Desktop platform selections made in Platform and Operating System.
You can select one or more original equipment manufacturers and multiple models per OEM.
New Android OEMs and models get added to the drop-down menu when devices are enrolled or synced.
|Model (Legacy)||This criteria option filters non Android and non Windows Desktop devices by model. Individual models displayed are based on the selections made in Platform and Operating System.
Select from the list of presented models to include in your smart group.
|Enterprise OEM Version||This criteria option filters devices by enterprise original equipment manufacturer version. You can select more than one Enterprise OEM version.
An Enterprise OEM version is a software-based classification applicable to OEM device models. For example, an Enterprise OEM version can be supplementary software support for devices such as Motorola’s Mobility Extensions (MX) or Samsung SAFE. An Enterprise OEM version can also be an OEM’s particular flavor of the Android operating system such as those offered by Honeywell, LG, and Sony among others.
|Management Type||Filter devices according to the way the device is managed.|
|Enrollment Category||Filter devices according to the way the device is enrolled.|
|Additions||This criteria option adds individual devices and users that are not included in the filtering criteria. You can select more than one device and more than one user.|
|Exclusions||This criteria option excludes individual devices, individual users, and user groups that are included in the filtering criteria. You can exclude more than one device, more than one user, and more than one user group.|
|Devices||Add a device to this Smart Group by entering the device friendly name. You can add more than one device using this method.|
|Users||Add users to this smart group by entering the user name, first name, or last name. You can add more than one user using this method.|
You can create a smart group defined by platform, ownership, user group, OS version, model, device tag, enterprise OEM, and even individual devices by friendly name.
For example, you can make a smart group containing all employee-owned iPhone Touch devices with iOS version earlier than 9.0.2. Add to this same smart group all Android devices by HTC version 2.0 with OS version 4.1 or greater. Out of this group, you can exclude devices in the user group “full time.” To this highly customized pool of *devices, you can assign 10 device profiles, 10 applications, or a compliance policy.
*Some restrictions might apply due to the multiplatform nature of this customized device pool. For example, there might be apps you want to assign that do not offer an Android version.
You can assign a smart group two ways.
You can assign a smart group when you add or create an application, book, compliance policy, device profile, or product provision.
You can also assign a smart group during the process of managing the smart group itself.
You can exclude groups from the assignment of device profiles and compliance policies with as much ease as assigning groups to these device products.
You must have the groups defined before you initiate this task. At a minimum, you must be able to make a smart group comprised of the users you want to exclude. This task allows you to make a new smart group on the fly but if you prefer to exclude an organization group or user group, then see the section titled Create Organization Groups in Organization Groups and User Groups respectively.
Select Save and Publish (for device profiles) or Next (for compliance policies) and continue the process for those tasks.
If you select the same group in both the Assigned Groups and Excluded Groups settings, then the profile or policy fails to save.
Next Steps: Preview the affected devices by selecting View Device Assignment.
This is a companion task to the video of the same name.
How to Make a Smart Group, Smartly (Right-click and select Open Link in New Tab)
In one tab of your browser, you can have the video play, pausing as necessary, and in another tab, scroll through this task which includes all the details left out of the video.
1. Move to the Organization Group You Want to Manage the Smart Group From
Content packages such as device profiles, compliance policies, apps, books, and so on, are created from and managed by a specific organization group (OG), same as devices. You are able to include these content packages in a smart group only if you create the smart group from the same OG the content packages were created from.
Use the OG selector to move to the child OG that contains the content packages (apps, books, device profiles, compliance policies, and so on) you want to include in the smart group. You can identify the managed OG for any content package. Select the content package from its List View and then review the selected Managed By option.
For example, if you want to assign a device profile to your smart group, navigate to Resources > Profiles & Baselines > Profiles, locate the name of the device profile you want to assign to your smart group from the listing and see the Managed By column for that profile. This is the OG you move to before you make your smart group.
Note that you still have access to content created in all parent OGs above the OG you move to. This means you can assign content to the smart group from the OG you are in and also from all parent OGs above.
2. Create the Smart Group
Once you are in the organization group that contains your targeted content packages, proceed with making the smart group.
3. Assign the Smart Group
There are 2 different scenarios when to assign smart groups.