Smart Groups
Smart groups are dynamic user groups created and managed based on Active Directory group, user attributes, and device attributes. The members of a smart group are defined dynamically in WebUI, rather than being manually defined by an administrator. You can target multiple devices using smart groups that a user or a device is subscribed to and you can manage apps, device access, group membership and so on.
Advantages
Smart groups facilitate scalable management of MDM-enrolled devices via user-based enrollment and device targeting. If you have defined a smart group, you can:
- Deploy customized policies such as passcode policy, restriction policy, certificate policy for a specific set of devices.
- Trigger customized actions such as lock, wipe as applicable on specific set of devices.
Smart groups can also be used as an effective access control system to provide access permissions to resources based on user attributes, such as job title, department, or location, and device attributes, such as operating system. For example, you can create a smart group to include all users who belong to "Engineering" department, located in "the United States", using iOS mobile phones, and you can grant access to specific engineering-related resources applicable to iOS mobile phones compliant to the United States.
With Smart Group, you can manage users where you can store user and attribute data.
Best practices
- Create Smart Groups to define either user or device criteria that must be met by a new enrollment to match a specific Policy Group and associated configuration.
- Smart Group name:
- It should reflect the set of criteria defined in the smart group.
- Avoid any specific device type references unless the smart group contains device criteria that identifies a specific device and/or specific OS criteria.
- Avoid any application or policy references, as those are not defined within a Smart Group.
- The same Smart Group can apply to any number of Policy Groups.