9.2 How groups work
One group per machine, first match wins
- If an administrator has assigned the machine to a group by hand (Agents → Agents, machine drawer → Policy group), that group is used. A manual assignment overrides all targeting.
- Otherwise the server tests the enabled groups from top to bottom and uses the first one whose targeting matches the machine.
- If no group matches, the machine is in Default and receives only Common items and the Default settings.
A machine is therefore always in exactly one group, or in Default. Put narrow groups above broad ones. A catch-all group at the top would take every machine.
Disabled groups are skipped completely. A machine assigned by hand to a disabled group falls back to targeting, and then to Default.
Common + group (additive) delivery
| Item has… | Who receives it |
|---|---|
| no group | Everyone (Common): Default machines and every group. |
| one or more groups | Only machines in those groups, in addition to the Common items. |
| excluded groups | Everyone it would otherwise reach, except the excluded groups. Exclusion always wins. |
This applies to labels, classification rules, Outlook rules, screen watermark rules, screen capture protection rules and awareness messages. Groups are not isolated silos: a Finance machine gets Common + Finance items. There is no need for combined groups, because one item can be assigned to several groups.
After filtering, the server also removes broken references for each group. A rule, Outlook rule or screen watermark rule whose label does not reach the group is dropped, and so is a default label that does not reach the group.
When a machine receives both a Common screen watermark rule and one assigned to its own group, the group’s rule is placed first. The endpoint draws the first matching always-on watermark, so the group’s own rule wins.
What a group carries
| Per-group item | Where you set it |
|---|---|
| Targeting (machine name / OS / AD) | Policy → Groups (this page) |
| Labels delivered to the group, excluded groups, per-group restriction exceptions | Policy → Labels → label drawer → Group targeting / Group exceptions (section 8.9) |
| Classification rules, Outlook rules | Policy → Rules → Classification Rules / Outlook Rules, with Scope set to the group or using the rule’s group fields (chapter 10) |
| Screen watermark and screen capture protection rules | Policy → Rules → Screen Watermark (section 10.3) |
| Awareness messages | Policy → Rules → Awareness (section 10.4) |
| Enforcement: label required on save/send/print, Check attachment labels, Label from attachments, unlabeled attachments, Outlook send mode, Default label, macOS prompt on save, content-based detection | Policy → Rules → General Enforcement (section 10.5), Scope = group |
| Agent modules (including web add-in apps and AI), Sync interval, tamper protection (on/off and an optional group-specific uninstall password) | Policy → Rules → Agent Rules (section 10.6), Scope = group |
Logs (client event switches) has no group scope. It applies to every agent.
Signed policy per group
The server builds and signs a separate policy for Default and for each group. A machine never receives another group’s items, targeting patterns, AD SIDs or exceptions. The policy also tells the agent its group name, which users can see in the tray app’s About window on Windows.