9.3 Targeting methods
Choose one method per group in Assign machines by. Methods cannot be mixed in one group.
| Method | UI option | Matches | Notes |
|---|---|---|---|
| Machine name | machine name | The machine name the agent reports, against comma-separated patterns. | * wildcard, case-insensitive, whole-name match.
FIN-* matches FIN-LAPTOP-07 but not
XFIN-1. |
| Operating system | operating system | The OS text the agent reports (shown on the Agents page), against comma-separated patterns. | *Windows 11*, *Windows Server*,
*macOS*. A machine that has not yet reported its OS matches
nothing. |
| Active Directory | AD group / user / e-mail | Any of the entries listed below. | Only offered when Active Directory is enabled. |
AD entry types (one group can mix them):
| Entry | Added with | Matches when |
|---|---|---|
| AD group | AD picker | The user signed in on the machine is a member of the group, including nested membership. Matching is by SID, so renaming the group in AD does not break it. |
| AD user | AD picker | That user is signed in on the machine (by SID). |
| AD computer | AD picker | The computer’s name equals the machine’s reported name or its full
DNS name (case-insensitive, trailing $ ignored). No
directory lookup is needed at run time, so this works even when nobody
is signed in. |
| Add mail field | The machine’s mailbox matches. The mailbox is the signed-in user’s
directory e-mail. If the directory has none, it is the Outlook profile
address the agent reports. Both are shown as Mailbox in
the agent drawer. Three forms: full address
j.smith@contoso.com, domain contoso.com
(everyone in it, exact domain), and wildcard *@contoso.com
or *.contoso.com (sub-domains). |
Machines that never match AD entries. A machine that is not domain-joined, or where a local account is signed in, has its AD groups and directory mail cleared. It cannot match AD group or user entries, even if an AD user with the same name exists.
Mailboxes and the Outlook web panel
Office web add-ins run in a browser and do not know which machine they are on. By default they receive the Default policy (Common items only). Two features let them follow a group:
- Mail targets: the Outlook web panel (new Outlook, Outlook on the web, Outlook for Mac) sends the signed-in user’s address. The server picks the first group from the top whose mail entries cover it. This works only when the panel presents a valid token: the Microsoft 365 add-in key (Agents → Setup) or a machine token. Only mail entries are used for this. Group, user, computer, host and OS targets cannot be resolved from an address.
- Machine-aware web panels (Policy → Rules → Agent Rules → Web add-in catalog): on machines with an agent, the Word, Excel and PowerPoint web panels receive that machine’s group policy.
Web panels always receive the reduced public policy, which contains no secrets.