Dynamic groups let you organize devices by their technical parameters—things like OS version, memory, or custom fields—without sorting them one by one.

Unlike folders, where you add devices and assign profiles by hand, a dynamic group is defined by filter conditions. Its membership updates on its own as devices change, so the group always reflects what's actually in your environment.

And because membership is based on conditions rather than where a device sits, a device can belong to several groups at once. Each group can carry its own IT automation and Threshold profiles, so you can act on all of a device's properties at the same time. 

Create a dynamic group

You build a dynamic group from the Devices page: filter your device list, then save that filtered view as a named group. Whatever filters you apply become the group's live definition.

To create a dynamic group:

1. In the navigation panel, go to the Devices page and click Filters.

2. Select the filters you want to group your devices by.

Note on unsupported filters

A few filters can't be saved as part of a group. If any of these are selected, you won't be able to save your view as a group:

• Filters: SNMP type, Availability, Alert category, Alert severity.
• Advanced filters: Last reboot, Last seen, Available patch, Installed patch, Available patch class, OS patching status, Installed software, Software patching status, Work from Home, non-agent monitored custom fields, time-based custom fields.

Dynamic groups only include agent-monitored devices. The Device type filter applies to agent devices only, so non-agent monitored devices (SNMP, HTTP, TCP, and Generic) won't be part of a group.

3. (Optional) Click Advanced filters to add more conditions, then click Apply.

Note: Conditions combine with AND/OR logic, so you can build precise, reusable groups. For example: OS version = Windows 11 AND (Memory = 16 GB OR Memory = 32 GB).

4. Click Save next to the views dropdown, at the top left of the page.

5. Switch the toggle to Group, enter a name in the Group name field, and click Save. 

Your group now appears in the Default view dropdown.

Assign an IT automation profile to a group

Assigning an IT automation profile to a group targets devices based on their current properties. Membership is read live each time the profile runs—not fixed at the moment you assign it—so the right devices are always targeted as they join or leave the group.

Note: More than one automation profile can target the same device through different groups. If their actions contradict each other, both will still run—there's no automatic deconfliction.

To assign an automation profile to a group:

1. In the navigation panel, go to Admin > Monitoring and automation > Patch management and IT automation. 
2. Click the three-dot icon next to the profile you want to assign, then click Assign.

3. Open the Groups tab and choose the groups you want from the Assign to groups dropdown. 

4. Click Save.

The profile now applies to all current and future members of the group(s).

Assign a Threshold profile to a group

Assigning a Threshold profile to a group applies it to every device in that group. Because a device can belong to several groups at once, it can hold multiple Threshold profiles at the same time—each one monitoring a different set of its properties.

Note: When a device picks up Threshold profiles from more than one group and their monitored items overlap, the most recently edited profile wins for those items. There's no manual priority setting.

To assign a Threshold profile to a group:

1. In the navigation panel, go to Admin > Monitoring and automation > Thresholds.
2. Click the three-dot icon next to the profile you want to assign, then click Assign profile.

3. Open the Groups tab and choose the groups you want from the Assign to groups dropdown.

4. Click Save.

The profile now applies to all current and future members of the group(s).

Use cases

Cross-site OS upgrades: You need to upgrade every Windows 10 device to Windows 11, but they're spread across multiple sites.

• Create a group for all devices running Windows 10.
• Scope it to specific sites, or apply it across all of them.
• Assign an "upgrade" IT automation profile.
• As the rollout progresses, devices drop out of the group automatically, so it shrinks on its own.

OS-specific monitoring: Devices running macOS 14 (Sonoma) and macOS 15 (Sequoia) have different compatibility requirements but share the same hardware baseline.

• Create a separate group for each macOS version.
• Assign a dedicated Threshold profile to each.
• Devices keep their hardware baseline from a broader group while also holding their OS-specific profile at the same time.

Multi-department memberships: An employee supports two departments and needs software from both, but a device can only sit in one folder.

• Tag the device with two agent custom fields, one per department.
• Create a group for each.
• Because the device matches both groups, it automatically receives the software policies assigned to each—no duplication, no manual overrides.

Compliance targeting: Some devices aren't meeting your security requirements, and finding and targeting them by hand takes time.

• Use a script to write a compliance state into an agent custom field.
• Create a group based on that field.
• Assign a "remediation" IT automation profile to the group.
• Because membership is read live on every run, newly non-compliant devices get picked up with no manual step.

How profiles behave

When a device belongs to multiple groups, overlapping monitored items can lead to conflicting actions. Here's what happens:

• Threshold profiles: The most recently edited profile wins. For example, if Profile A was assigned first but edited after Profile B, Profile A's settings apply to the overlapping items.
• IT automation profiles: Both profiles run. For example, if Profile A installs a software update and Profile B uninstalls it, both actions still run.

When a device leaves a group, that group's profiles stop applying to it.

If you delete a group that has profiles assigned, the link breaks—any device that was targeted through that group loses the assignment.

Static folders vs. dynamic groups

Folders and dynamic groups work together rather than replacing each other. Folders give you a stable, hierarchical structure; dynamic groups take over when device properties define the target. Using them together gives you the most flexibility. For more on folders, see Use folders to manage devices.

FAQ

Do dynamic groups replace folders? 

No—they complement them. Folders are best for a stable organizational structure, while dynamic groups are built for attribute-based or compliance-driven targeting.

Can a device be in more than one group? 

Yes. A device joins every group whose filter conditions it matches, so it can belong to several at once.

Can I group by patch status or installed software? 

No. Patch and software inventory fields aren't supported as filter conditions for dynamic groups.

What if two IT automation profiles on one device contradict each other? 

Both run. There's no auto-deconfliction, so it's worth reviewing automation assignments across overlapping groups to avoid conflicts.

Can a device receive multiple Threshold profiles? 

Yes, if it belongs to more than one group. When monitored items overlap, the most recently edited profile wins for those items.

What happens when a device no longer matches a group's conditions? 

It automatically leaves the group, and that group's profiles stop targeting it.

What if I delete a group that has profiles assigned? 

The link breaks. The profiles themselves still exist, but they no longer apply through the deleted group.