Dynamic device groups (dynamic groups) collect devices by their properties, such as OS version, memory, an agent custom field, or alert severity, instead of by the folder they sit in. Save a filtered view on the Devices page as a group and assign IT automation profiles, Threshold profiles, or configuration policies to it, and Atera keeps the membership up to date as devices change.

Watch this video guide on setting up a dynamic group:

Before you begin

Create a dynamic group

You build a dynamic group on the Devices page: filter the device list, then save the filtered view as a group. The filters you save become the group's definition. For example, a group defined as OS version = Windows 10 AND Memory = 8 GB collects every matching device in one place, wherever it sits.

To create a dynamic group:

1. Go to the Devices page and click Filters.

   

    

2. Select the filters that define the group. Check Filters you can't use in a dynamic group below first, because an unsupported filter blocks saving.

   

    

3. (Optional) Click Advanced filters to add more conditions with AND/OR logic, for example OS version = Windows 11 AND (Memory = 16 GB OR Memory = 32 GB), then click Apply.

4. Click Save next to the views dropdown, at the top left of the page. If a saved view or group is already open, select Save as from the menu that opens.

   

    

5. In the Save as dialog, select Group.

   

    

6. Enter a name in the Group name field, up to 49 characters.
7. Click Save.

The group appears under Groups in the views dropdown, marked with a groups icon. Atera starts adding matching devices right away, and membership usually fills in within a couple of minutes.

Filters you can't use in a dynamic group

You can build a dynamic group from any filter on the Devices page except the ones below. If one of them is selected, the Save as dialog shows You can't create a group because these filters aren't supported in device groups., lists the filters to remove, and keeps Save disabled.

• Filters: SNMP Type, Availability.
• Advanced filters: Agent version, Last reboot, Last seen, Available patch, Installed patch, Available patch class, OS patching status, Installed software, Software patching status, Work from Home, custom fields for non-agent monitored devices, and time-based custom fields.

Tip: To group devices by a property you can't filter on, have a script write the value into an agent custom field, then build the group on that field. For example, a script can record a compliance state, and a group on that field collects every non-compliant device. This doesn't work for time-based values.

Assign profiles and policies to a dynamic group

When you assign a profile or policy to a dynamic group, it applies to every device in the group now and to every device that joins later. When a device leaves the group, the group's profiles and policies stop applying to it.

Watch this video on assigning profiles to a dynamic group:

Assign an IT automation profile to a dynamic group

You need the Manage IT automation permission. Atera reads the group's membership each time the profile runs, so the profile always targets the devices that match at run time.

1. Go to Admin > Monitoring and automation > Patch management and IT automation.

2. Click the three-dot icon next to the profile, then click Assign.

   

    

3. Open the Groups tab.
4. Select one or more groups from the Assign to groups dropdown.

5. Click Add.

   

    

6. Click Save.

Each group you added now appears under Assigned groups.

Assign a Threshold profile to a dynamic group

You need the Manage thresholds or Edit devices permission. Because a device can belong to several groups, it can get Threshold profiles from several groups at the same time.

Important: Once a device gets a Threshold profile through a dynamic group, the Threshold profiles it inherits from its folder and above stop applying to it. They aren't combined. Make sure the group's profile covers everything you want to monitor on those devices.

1. Go to Admin > Monitoring and automation > Thresholds.

2. Click the three-dot icon next to the profile, then click Assign profile.

   

    

3. Open the Groups tab.
4. Select one or more groups from the Assign to groups dropdown.

5. Click Add.

   

    

6. Click Save.

Each group you added now appears under Assigned groups.

Assign a configuration policy to a dynamic group

You need admin access. Configuration policies apply to Windows devices only, not Windows Home, so other devices in the group aren't affected. A dynamic group carries one configuration policy at a time.

1. Go to Admin > Monitoring and automation > Configuration policies.
2. Open the policy you want to assign.

3. Open the Assignment tab, then the Groups tab.

   

    

4. Select one or more groups from the Assign to groups dropdown.

5. Click Add.

   

    

6. Click Save.

Each group you added now appears under Assigned groups.

Dynamic group use cases

These examples show common ways to combine dynamic group filters with profile assignments.

Roll out an OS upgrade across your environment

You need to upgrade every Windows 10 device to Windows 11, and the devices aren't all in one folder.

1. Create a dynamic group with the filter OS version = Windows 10.
2. (Optional) To limit the rollout to part of your environment, add another filter, such as a folder. Leave it out to include every matching device.
3. Assign an IT automation profile that runs the upgrade.

As each device upgrades, it stops matching the filter and leaves the group, so the group shrinks on its own as the rollout progresses.

Monitor each macOS version separately

Devices on macOS 14 (Sonoma) and macOS 15 (Sequoia) have different compatibility requirements but share the same hardware baseline.

1. Create a dynamic group for each macOS version.
2. Assign a dedicated Threshold profile to each version group.
3. Assign the shared hardware baseline Threshold profile to a broader dynamic group, such as one for all macOS devices.

Each device matches both its version group and the broader group, so it gets both Threshold profiles. If both profiles monitor the same item, the most recently edited profile wins for that item. Keep the baseline in a group rather than on the folder, because a folder's Threshold profile stops applying once a device gets a Threshold profile through a dynamic group.

Give one device the software of two departments

An employee supports two departments and needs software from both, but a device can sit in only one folder.

1. Tag the device with two agent custom fields, one per department.
2. Create a dynamic group for each field.
3. Assign each department's IT automation profile to its group.

The device matches both groups, so it automatically gets the IT automation profiles assigned to each, with no duplicate profiles or manual overrides. Because both profiles run, check that they don't contradict each other.

Target non-compliant devices automatically

Finding and fixing devices that don't meet your security requirements by hand takes time.

1. Use a script to write a compliance state into an agent custom field.
2. Create a dynamic group based on that field.
3. Assign a remediation IT automation profile to the group.

Because Atera reads the group's membership each time the profile runs, newly non-compliant devices get picked up with no manual step once group membership updates.

Edit, convert, or delete a dynamic group

Only admins can edit, convert, or delete a dynamic group.

To change a group's name or filters:

1. On the Devices page, open the views dropdown and select the group.
2. Change the filters.
3. Click the arrow next to Save, then select Update.
4. (Optional) Change the name in the Group name field.
5. Click Save.

Devices that no longer match leave the group, and devices that now match join it, usually within a couple of minutes.

To turn a group back into a regular view: follow the steps above, select View in the dialog, and click Save. In the Convert group to view confirmation, click Convert to view.

Warning: Converting a group to a view deletes the group and permanently removes every profile and policy assignment made through it. This can't be undone. Reassign the profiles elsewhere first if the devices still need them.

To delete a group:

1. On the Devices page, open the views dropdown.
2. Click the trash icon next to the group.
3. In the Delete group confirmation, click Delete group.

The group no longer appears in the views dropdown.

Warning: Deleting a group permanently removes every profile and policy assignment made through it. The profiles and policies still exist, but devices that got them only through this group lose them. This can't be undone.

How dynamic groups behave

How fast dynamic group membership updates

Dynamic group membership updates automatically, usually within a couple of minutes. When Atera is processing a lot of device updates at once, it can take longer. This applies when you create or edit a group, when a device's properties change, and when a new device is added.

When a device is in more than one dynamic group

A device joins every dynamic group whose filters it matches. When those groups carry overlapping profiles:

• Threshold profiles: if two profiles monitor the same item with different settings, the most recently edited profile wins for that item. This depends on when each profile was last edited, not the order you assigned them. There's no manual priority setting.
• Configuration policies: the most recently edited policy wins, the same way.
• IT automation profiles: all of them run. There's no automatic deconfliction.

Important: If two IT automation profiles reach the same device through different groups and contradict each other, for example one installs an update and the other uninstalls it, both actions run. Review your automation assignments across overlapping groups.

Dynamic groups also sit in an order with your other assignments. For Threshold profiles and configuration policies, Atera uses the first of these that applies: an assignment made directly to the device, then the device's dynamic groups, then its folder, then its customer. When a device's groups give it Threshold profiles, Atera combines those profiles into one, and that replaces the folder and customer Threshold profiles. IT automation profiles work differently: profiles from groups add to the device's other IT automation profiles rather than replacing them.

Dynamic groups also sit in an order with your other assignments. For Threshold profiles and configuration policies, Atera uses the first of these that applies: an assignment made directly to the device, then the device's dynamic groups, then its folder, then its site. When a device's groups give it Threshold profiles, Atera combines those profiles into one, and that replaces the folder and site Threshold profiles. IT automation profiles work differently: profiles from groups add to the device's other IT automation profiles rather than replacing them.

Who can see a dynamic group

Every technician can see dynamic groups in the views dropdown on the Devices page. A technician sees only the member devices from customers their role can access. If a group contains devices from a customer the technician can't access, they see the group's name but not its members.

Every technician can see dynamic groups in the views dropdown on the Devices page. A technician sees only the member devices from sites their role can access. If a group contains devices from a site the technician can't access, they see the group's name but not its members.

Dynamic groups and folders

Dynamic groups work alongside folders, not instead of them. A folder is a fixed place you move devices into by hand. A dynamic group collects devices by their properties. You can also use a folder as one of a group's filters. For more on folders, see Use folders to manage devices.

Related articles

• Use folders to manage devices
• Configuration policies: manage
• Threshold profiles (assign and manage)
• IT automation profiles (create and assign)