Groups let you apply a policy override to a subset of your device fleet without touching the org-wide baseline or configuring each device individually. Device groups are managed from the Devices → Groups tab in the dashboard.
A device belongs to at most one group at a time. If a device is moved to a different group, it immediately starts receiving that group’s policy on the next agent poll.
Creating a Group
- Go to Devices and click the Groups tab.
- Click New Group.
- Enter a name (required) and optional description.
- Click Create.
The group appears immediately and is ready to receive devices and a policy override.
Adding Devices to a Group
Expand a group card by clicking on it, then click + Add device to assign a device. The dropdown shows only devices that are currently Active and not already assigned to another group.
To remove a device from a group, expand the group and click Remove next to the device. Removed devices fall back to the org-wide policy immediately.
Renaming or Deleting a Group
From the group row, use the Rename or Delete buttons (visible to Org Admins only).
Deleting a group removes all device assignments and removes any group-scoped policy overrides. Devices in the deleted group fall back to the org-wide policy immediately. This cannot be undone.
Applying a Policy to a Group
Once a group exists, configure its policy override in the Policies page:
- Go to Policies.
- Select the policy type (App Config, Flow Config, DLP Config).
- Click Group override and choose the group.
- Edit the fields you want to override (unset fields fall through to org-wide).
- Click Save.
Access Control
Only Org Admins can create, rename, delete groups or modify device membership. Analysts and App Users can view group information but cannot make changes.
Managing Groups via Code
For large fleets or GitOps workflows, manage groups programmatically using the Policy-as-Code CLI or Python SDK:
# Create a group
agent-charley-cli groups create finance --description "Finance team devices"
# Assign devices by email
agent-charley-cli groups add-members finance --email alice@company.com
# Or manage via YAML alongside policy files
agent-charley-cli apply --file policies/ --groups groups.yaml
