Register a group

A group can be comprised of users or devices. You can add a manual group, which is static, or a dynamic group, which auto-updates group memberships and assignments based on pre-set criteria.

Add a manual group

1. On the Group page, click Add. The Add Group page opens.

2. Enter the following user information:

   • Name — Enter a group name.

   • Type — Select one of the following group types:

     • User — A group of user accounts.
     • Device — A group of enrolled devices.

   • Membership Type — Select Manual.

   • Sub-Administrator — Click Select, then select a sub-admin for the group in the Select Sub-Administrator dialog, and click OK.

     • For an overview of admin roles, see Admin account overview.
     • To add a sub-admin for Knox Manage, see Add an administrator.
     • Alternatively, to add a sub-admin for all Knox services, see Manage admins and roles for Knox services in Knox Admin Portal documentation.

3. On the All Users or All Devices list (depending on your selected Type), select user IDs or device names to include them in the group. Selected users or devices appear under Selected User or Selected Device, correspondingly.

   • You can use the search bar in the All Users or All Devices area to find records matching your search criteria.
   • You can further refine your device selections in the Selected Device area: Click Select via Filter, select filters that you want to apply, then click OK.

4. Save your new group by clicking Save, then in the Save Group dialog click OK.

5. Alternatively, click Save & Assign. In the Save & Assign dialog, select Application (to assign apps), Profile (to assign profiles), or Content (to assign content files).

6. Click Next to proceed with the assignment flow.

Add a dynamic group

1. On the Group page, click Add. The Add Group page opens.

2. Enter the following user information:

   • Name — Enter a group name.

   • Type — Select one of the following group types:

     • User — A group of user accounts.
     • Device — A group of enrolled devices.

   • Membership Type — Select Dynamic.

   • Sub-Administrator — Click Select, then select a sub-administrator for the group in the Select Sub-Administrator dialog, and click OK.

     For an overview of administrator roles, see Administrator account overview. To add a sub-administrator for Knox Manage, see Add an administrator. Alternatively, to add a sub-administrator for all Knox services, see Manage admins and roles for Knox services in Knox Admin Portal documentation.

3. (Optional) Under Group Assignment, define whether you want profiles and apps to be automatically assigned or unassigned depending on group membership. Select one, or both, of the following checkboxes:

   • When a user or device is added, the profiles and applications assigned to the group will be pushed to the user or device
   • When a user or device is removed, the profiles and applications of the group will be unassigned from the user or device

4. Next, configure the rules in your group. Select one of the following methods to create rules.

   Filters

   Lets you create rules through user or device attributes.

   Click Make rules via Filter. On the Make rules via Filter dialog, fill the user or device attribute fields to search for associated users or devices, then click Apply rules. Corresponding rule syntax is generated and appears in the Rule Syntax field.

   Configuration

   Define the conditions that mark the user or device as a part of the group. To use this option, set Rule Builder Type to Configuration.

   Conditions are combined using either the AND or OR logic operators. Click (Add icon) to add another, or click (Delete icon) to remove one. You can add up to five conditions per group.

   For each entry, select an attribute, an operator (such as Equals or Not equals), and a value. Attributes vary depending on whether the group is a user or device group.

   Click the Rule Configuration tooltip to see a rule configuration guide for common user and device attributes.

   The following attributes are available for user groups. Many of these attributes, such as Employee number or Department, can be set when you modify a user.

   Conditions	Description
   User ID	Marks users as part of the group based on the selected operator and their user ID, the unique identifier for the user's account.
   User Name	Marks users as part of the group based on the selected operator and their user name.
   First Name	Marks users as part of the group based on the selected operator and their first name.
   Middle Name	Marks users as part of the group based on the selected operator and their middle name.
   Last Name	Marks users as part of the group based on the selected operator and their last name.
   Display Name	Marks users as part of the group based on the selected operator and their display name.
   Employee No.	Marks users as part of the group based on the selected operator and their employee number.
   Department	Marks users as part of the group based on the selected operator and the department the user belongs to.
   Administrator DN	Marks users as part of the group based on the selected operator and the Distinguished Name (DN) of the administrator who manages them.
   Email	Marks users as part of the group based on the selected operator and the user's email address.
   Email User Name	Marks users as part of the group based on the selected operator and the user name portion of the user's email address.
   Phone No.	Marks users as part of the group based on the selected operator and the user's phone number.
   Mobile No.	Marks users as part of the group based on the selected operator and the user's primary phone number.
   User Principal Name (UPN)	Marks users as part of the group based on the selected operator and their User Principal Name (UPN), the sign-in name consisting of their user account name and a domain, like an email address.
   Distinguished Name (DN)	Marks users as part of the group based on the selected operator and the user's Distinguished Name (DN), the unique identifier used to locate the user in an LDAP or Active Directory.
   Organization Code	Marks users as part of the group based on the selected operator and the code assigned to the organization they belong to.
   Position Code	Marks users as part of the group based on the selected operator and their position code.
   Work Location Code	Marks users as part of the group based on the selected operator and their work location code.
   Security Level Code	Marks users as part of the group based on the selected operator and the code assigned to the user's security level.
   User-Defined 1	Marks users as part of the group based on the selected operator and their User-Defined 1 value.
   User-Defined 2	Marks users as part of the group based on the selected operator and their User-Defined 2 value.
   User-Defined 3	Marks users as part of the group based on the selected operator and their User-Defined 3 value.
   Organization Name	Marks users as part of the group based on the selected operator and the name of the user's organization.
   VPP Status	Marks users as part of the group based on the selected operator and the user account's status.
   Source	Marks users as part of the group based on the selected operator and the source the user account was created from.
   Created	Marks users as part of the group based on the selected operator and the date the user account was created.

   The following attributes are available for device groups:

   Condition	Description
   Device Name	Marks devices as part of the group based on the selected operator and the device's name.
   Device Tag	Marks devices as part of the group based on the selected operator and any tags assigned to it.
   Device Alias	Marks devices as part of the group based on the selected operator and the nickname assigned to the device.
   Enrollment Type	Marks devices as part of the group based on the selected operator and the method it was enrolled.
   Firmware Version	Marks devices as part of the group based on the selected operator and their firmware version.
   IMEI	Marks devices as part of the group based on the selected operator and the device's International Mobile Equipment Identity (IMEI).
   Secondary IMEI	Marks devices as part of the group based on the selected operator and the device's secondary International Mobile Equipment Identity (IMEI), used to identify the second SIM slot on dual-SIM devices.
   IMSI	Marks devices as part of the group based on the selected operator and their International Mobile Subscriber Identity (IMSI), the unique code to identify the device users on a cellular network.
   Lock Status	Marks devices as part of the group based on the selected operator and the device's lock status.
   MAC Address	Marks devices as part of the group based on the selected operator and the device's MAC address, the unique alphanumeric sequence connected to the hardware component which identifies the device when it connects to a network.
   Management Type	Marks devices as part of the group based on the selected operator and its management type.
   Mobile Number	Marks devices as part of the group based on the selected operator and the mobile number associated with the device.
   Model	Marks devices as part of the group based on their device model and the selected operator.
   OS version	Marks devices as part of the group based on the selected operator and the version of the operating system installed on the device.
   Platform	Marks devices as part of the group based on the selected operator and the device's platform.
   Serial number	Marks devices as part of the group based on the selected operator and the device's serial number.
   Status	Marks devices as part of the group based on the selected operator and the device's status.
   Status Last Updated	Marks devices as part of the group based on the selected operator and the date and time the device's status was last updated.
   User ID	Marks devices as part of the group based on the selected operator and the User ID of its associated user.
   Device Control Type	Marks devices as part of the group based on the selected operator and the control type applied to the device.
   Shared device type	Marks devices as part of the group based on the selected operator and whether the device is set up as a shared device.
   Knox Manage Type	Marks devices as part of the group based on the selected operator and the Android Legacy type applied to the device.
   Device Type	Marks devices as part of the group based on the selected operator and the iOS or iPadOS type applied to the device.

   Syntax

   The Rule Syntax field lets you write rules in MVFLEX Expression Language (MVEL) syntax (up to 1,000 characters). To use this option, Rule Builder Type must be set to Syntax. See Set dynamic group syntax to learn more.

5. Once you set at least one rule, you can use the Validation area to inspect which users or devices fulfill rule criteria.

   • Click Select to bring up the Select User or Select device dialog, select from existing records, and click Add.

     • You can use the search bar to find specific user or device records.
     • To further refine your device selections, click Select via Filter, select filters that you want to apply, then click OK.

   • The Validate button becomes active, and selected records appear below it. Click Validate.

   • Status values appear, indicating the rule evaluation status for each row. Click on the corresponding View Details link for further information.

   • If needed, proceed to tweak your rules in the Rule Builder (step 4), then revalidate against selected records (step 5).

6. To save your new dynamic group, click Save, then in the Save Group dialog click OK to confirm your intent.