Manage device groups

Platform 6.7+

A device group is a named set of devices that golden configuration trees, compliance plans, and Studio workflow tasks target as a single unit. In Platform 6.7, you can build a group from Inventory Manager tags as well as from device names. You can also see which trees and plans use each group and how its devices performed in their latest compliance checks.

This page is for network operators and auditors who build device groups and run compliance against them.

How device groups work

Keep these behaviors in mind when you build and maintain a device group:

Membership is a snapshot: A group contains the devices you selected when you saved it. If tags or inventory change later in Inventory Manager, the group doesn’t update. To bring a group up to date, add devices to it again.
Devices can come from more than one source: One group can hold devices you selected by name and devices you selected by Inventory Manager tag, including devices from more than one inventory.
Access control applies: You can only see and select the inventories, tags, and devices that your Inventory Manager permissions allow.
Consumers don’t change: Golden configuration trees, compliance plans, and Studio tasks use a tag-built group the same way they use any other device group.

Before you begin

Before you work with device groups, confirm that:

You have access to Configuration Manager.
To build groups from tags, the devices you want are in an inventory in Inventory Manager and have tags applied. See Tags and organization.
Your Inventory Manager permissions give you access to the inventories and tags you want to use. See Security and access control.

View device groups

To see all device groups, select Device Groups in the Configuration Manager left navigation. The Device groups page lists every group you can access.

Column	Description
Name	The group name. Select it to open the group’s details.
Status	The group’s compliance status from its most recent run, such as Non-Compliant. Groups that haven’t been checked show Not Run.
Description	The group description, if one was added.
OS Mix	The device operating systems in the group, such as Cisco IOS and Cisco NX.
Tags	The Inventory Manager tags associated with the group’s devices.
Last Run	How long ago a compliance check last ran against the group, such as Last run 3d ago.

Use the search box to find a group by name, description, OS mix, or tag. You can sort by Name, Status, and Last Run, and filter by Status, OS Mix, Tags, and Last Run. The Last Run filter offers the last 24 hours, 7 days, 30 days, 3 months, or 6 months, or groups that have never run.

Create a device group

You create a device group in the Create Device Group panel. The panel has two tabs for finding devices: Name and Inventory Tags.

On the Device groups page, select New Device Group.

Enter a Group Name. Optionally, enter a Description.

Select devices using one or both tabs:

Name: Lists every device available to you, with its Device OS and Source. Search the list, or filter and sort by name, device OS, or source. Select the checkbox for each device you want to add.
Inventory Tags: Select an Inventory, then select one or more Tags. The table lists the devices in that inventory that match the selected tags. To narrow the results, filter by Device Name or Device OS. Select the checkbox for each device you want to add, or select the checkbox in the header row to select every device in the list.

To add devices from another inventory, select a different Inventory and repeat. Devices you’ve already selected stay selected when you switch inventories.

The Devices Selected count shows how many devices you’ve chosen across all inventories.

Select Create.

The new group appears on the Device groups page with a status of Not Run.

Add devices to a group

Open the group from the Device groups page.

Select Add Devices. The Add Devices to Group panel opens.

Select devices on the Name tab, the Inventory Tags tab, or both. These tabs work the same way as they do when you create a group.

Confirm your selection to add the devices to the group.

A confirmation message shows how many devices were added to the group.

View group details

To open a group, select its name on the Device groups page. The top of the details page summarizes the group:

Field	Description
Status	The group’s compliance status from its most recent run.
Description	The group description, if one was added.
OS / Vendor Mix	The device operating systems in the group.
Tags	The Inventory Manager tags associated with the group’s devices.
Devices	The number of devices in the group.

Below the summary, the Devices and Recent activity tabs show the group’s members and its compliance history.

Devices tab

The Devices tab lists every device in the group.

Column	Description
Name	The device name, which links to the device’s details page. Devices from Inventory Manager use the format `<inventory-name>::<device-name>`.
Device OS	The device operating system.
Source	Where the device comes from, such as Inventory Manager, Automation Gateway, or an NSO instance.
Actions	Remove takes the device out of the group.

Search by name, device OS, or source, and sort or filter any column. The table shows 25 devices per page.

Recent activity tab

The Recent activity tab lists each golden configuration tree and compliance plan that uses the group. A row appears as soon as you add the group to a tree or plan, before any compliance check runs.

Golden configuration trees and compliance plans are part of Configuration Manager Enterprise. Without it, the Recent activity tab has no entries.

Column	Description
Type	The type and name of the tree or plan, in the format `Golden Configuration: <tree-name>` or `Compliance Plan: <plan-name>`. Each entry links to the golden configuration tree’s details page or the compliance plan’s details page.
Status	Non-Compliant if at least one device in the group failed the most recent check. Not Run if no check has run yet.
Last Run	How long ago the most recent check ran, such as Last run today.
Result	The number of non-compliant devices from the most recent check, such as 10 devices non-compliant. Devices that failed to connect during the check count as non-compliant.

The Recent activity tab gives a summary only. To see which devices failed compliance and which failed to connect, select the tree or plan and open its compliance report.

You can filter each column:

Type: Golden Configuration, Compliance Plan, or both.
Status: The compliance status of the most recent check.
Last Run: 24h, 7d, 30d, 60d, or 90d.
Result: Number of non-compliant devices that’s at least, at most, or between the values you enter.

Use the search box to find a row by type or status. Because the Type column includes the tree or plan name, you can also search by name.

Remove devices from a group

Removing a device takes it out of the group only. The device stays in its inventory or source system.

Remove one device: On the Devices tab, select Remove in the device’s row.
Remove several devices: Select the checkbox for each device, then select the delete icon above the table.

Delete a device group

You can’t delete a device group while a golden configuration tree or compliance plan uses it. Configuration Manager returns an error if you try. Remove the group from each tree and plan listed on its Recent activity tab first.

To delete a group, open it and select Delete. Deleting a group doesn’t delete its devices.

Inventory tags on device details

The Device Details card for a device from Inventory Manager includes an Inventory Tags field that lists the tags applied to the device. You can use it to check how a device is categorized without leaving Configuration Manager. For the other fields on this page, see View and manage devices.

Device groups in golden configuration trees and compliance plans

You add a device group to a golden configuration tree or a compliance plan the same way you did before Platform 6.7:

Golden configuration tree: Select a node, open the Devices & Groups tab, select Device Groups, and then select Add Device Groups.
Compliance plan: When you select nodes for a golden configuration tree in the plan, use the Device Group Selection tab.

After a compliance check runs, the results appear on the group’s Recent activity tab.

Device groups in Studio workflows

The Create Device Group and Add Devices to Group Studio tasks have an inventoryTags input alongside the existing deviceNames input. To use it, select an Inventory, then select one or more tags. When the task runs, it adds the devices in that inventory that match the selected tags.

Keep these behaviors in mind:

One inventory per task: Each task covers one inventory. To add devices from several inventories, add an Add Devices to Group task for each additional inventory.
Both inputs are optional: If you set deviceNames, inventoryTags, or both, the task adds those devices. If you leave both empty, Create Device Group creates a group with no devices, as it did before Platform 6.7.
Existing workflows keep working: Workflows that use only deviceNames don’t need changes.

If the user running the task doesn’t have access to the selected inventory, the task uses a different inventory that the user can access and adds devices from it. The group can end up with devices you didn’t intend to include. Make sure the account that runs the workflow has access to the inventory selected in the task.

Groups created before Platform 6.7

After you upgrade, existing device groups keep their devices. Their OS mix and the trees and plans that use them display automatically.

Compliance history from before the upgrade isn’t carried over, so existing groups show Not Run until their first compliance check after the upgrade.