Skip to main content
Groups apply a policy override to a segment of your device fleet. A device belongs to at most one group at a time. Removing a device from a group (or deleting the group) immediately returns that device to the org-wide policy.

Scope Hierarchy

A group policy overrides the same field in the org-wide policy. A device policy overrides both. Unset fields always fall through to the broader scope. Define groups alongside your policy files and apply them together:
On apply, the CLI will:
  1. Create any groups that don’t exist yet.
  2. Set the member list for each group (using set_members, which replaces existing membership).
Members can be specified as email addresses (all active devices enrolled by that user are added) or explicit device UUIDs.

Managing Groups via CLI

Managing Groups via Python SDK

Deleting a Group

Deleting a group:
  • Removes all device assignments immediately
  • Does not delete associated policies — they become orphaned and are ignored
  • Devices fall back to the org-wide policy immediately (agent picks this up on the next policy poll)

Getting Device UUIDs

Device UUIDs are available in the dashboard under Devices (the short ID under each device name), or via the API:
You can also list all devices with the Charley REST API:

Dashboard Management

Groups can also be created and managed in the dashboard under Devices → Groups. See Groups (Dashboard) for the UI walkthrough. Dashboard-created groups are fully compatible with the CLI/SDK — you can manage membership from either interface.