Fleet organization

Tenants, groups, smart groups, tags, and attributes — how to structure a fleet that scales from 5 to 10,000 devices.

The hierarchy

Tenant — your organization. One tenant = one company. Isolation is strict: data, auth, audit trail, billing all scoped per-tenant.
Groups — subdivisions inside a tenant. Nested one level deep (parent/child only).
Devices — leaves. Every device is in exactly one group. Unassigned devices land in a built-in "Unassigned" group that cannot be deleted.

Two kinds of groups

Manual groups

You assign devices explicitly. Good for physical structure: "Building A", "Floor 2", "Warehouse".

Smart groups

Define rules — devices that match the rules auto-join the group. Re-evaluated every 5 minutes. The rule builder supports fields (os_version, status, model, tags,agent_version, last_seen_minutes_ago), 8 operators, and match mode (ALL or ANY).

Example: a smart group with rule os_version < 17 AND last_seen_minutes_ago < 60 captures every online device that needs an OS update.

Smart groups are ideal for policy targeting. Put an update-required policy on a smart group and devices auto-enter the rollout as they fall behind — no manual reassignment.

Tags (arbitrary attributes)

Any device can have any number of tags. Tags are free-form strings set via the device detail page, API, or bulk CSV import. Typical uses: hospital:north, dept:emergency, pilot-wave-2.

Tags feed into smart group rules (tags contains "pilot-wave-2") and compliance rules.

How policy targeting uses the hierarchy

Policies attach at three levels:

Tenant default — every device inherits unless overridden
Group policy — overrides tenant for that group's devices
Device override — overrides group for a single device

Read Policies & inheritance for the full merge rules.

Scaling patterns

<100 devices — flat structure, one group per location
100-1000 devices — parent groups by region, child groups by site; smart groups for OS version pools
1000-10,000 devices — tag-heavy: every device gets region:, site:, role:, ring:. Policies target by smart group on tags.

Multi-tenancy (MSP use case)

If you manage fleets for multiple end-customers, create one tenant per customer. Users can belong to multiple tenants via SSO group mapping — they switch tenants in the top-right of the console.