To create, assign, edit, unassign, or delete a configuration policy, go to Admin > Monitoring and automation > Configuration policies. This article gives the steps for each task, including how to assign a policy to a site, a folder, a dynamic group, or a single agent (device), and how to check which policy is set on a device. For how policies are applied and what each configuration does, see Configuration policies: overview
To create, assign, edit, unassign, or delete a configuration policy, go to Admin > Monitoring and automation > Configuration policies. This article gives the steps for each task, including how to assign a policy to a customer, a folder, a dynamic group, or a single agent (device), and how to check which policy is set on a device. For how policies are applied and what each configuration does, see Configuration policies: overview
Before You Begin
Important: Creating, editing, and deleting configuration policies, and assigning them at the site, folder, or dynamic group level, requires Full admin access. There is no separate configuration policies permission in custom roles.
Important: Creating, editing, and deleting configuration policies, and assigning them at the customer, folder, or dynamic group level, requires Full admin access. There is no separate configuration policies permission in custom roles.
- Technicians without full admin access can assign a policy to individual agents only, as long as their role has access to that site.
- You can assign one configuration policy per site, per folder, per dynamic group, and per agent.
- Configuration policies apply to Windows devices. Windows Home editions are not supported.
- For restart settings to work, the device's IT automation profile must have Reboot if needed enabled. The custom restart message is limited to four lines.
- Technicians without full admin access can assign a policy to individual agents only, as long as their role has access to that customer.
- You can assign one configuration policy per customer, per folder, per dynamic group, and per agent.
- Configuration policies apply to Windows devices. Windows Home editions are not supported.
- For restart settings to work, the device's IT automation profile must have Reboot if needed enabled. The custom restart message is limited to four lines.
Where to Find Configuration Policies
All configuration policies are managed from the Admin menu.
1. Go to Admin > Monitoring and automation > Configuration policies.
The Configuration policies page appears and lists all existing policies.
To see or change the configuration policy set on a single device, open the device's Agent Console instead. See Assign a configuration policy to an agent
Create a Configuration Policy
A new configuration policy doesn't affect any device until you assign it.
To create a configuration policy:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Click New policy.
The Create new policy page appears.
3. Enter a policy name and description.
Note: The name is required, can have up to 100 characters, and must be unique. If the name is already used, you see That policy name is taken. The description can have up to 200 characters.
4. Toggle on the configurations you want to include, then select the settings for each one: Windows update restart configurations, Windows update settings, and Splashtop settings override. For what each option does, see Available configurations
5. Click Create (top right of the page).
The policy appears on the Configuration policies page. To apply it, assign it.
Note: Prompt every must be at least 5 minutes. Force restart after must be at least 1 prompt.
Assign a Configuration Policy
You can assign a configuration policy to sites, folders, dynamic groups, and individual agents. Site, folder, and dynamic group assignments are made inside the policy, on its Assignment tab. Agent assignments are made from the device's Agent Console.
You can assign a configuration policy to customers, folders, dynamic groups, and individual agents. Customer, folder, and dynamic group assignments are made inside the policy, on its Assignment tab. Agent assignments are made from the device's Agent Console.
A device follows only one policy: the first that applies, in this order: a policy assigned directly to the agent, then a policy assigned to one of its dynamic groups, then its folder's policy, then its site's policy. For details, see Policy inheritance and supersession
A device follows only one policy: the first that applies, in this order: a policy assigned directly to the agent, then a policy assigned to one of its dynamic groups, then its folder's policy, then its customer's policy. For details, see Policy inheritance and supersession
Assign a Configuration Policy to a Site
Assigning a configuration policy to a site applies it to every folder and agent under that site that doesn't have its own policy. You can assign one policy per site.
To assign a policy to a site:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy (or create a new one).
3. Click the Assignment tab.
4. From the dropdown, select one or more sites.
5. Click Add.
6. Click Save (top right of the page).
The sites appear under Assigned sites, and the policy is applied to their devices.
Assign a Configuration Policy to a Customer
Assigning a configuration policy to a customer applies it to every folder and agent under that customer that doesn't have its own policy. You can assign one policy per customer.
To assign a policy to a customer:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy (or create a new one).
3. Click the Assignment tab.
4. From the dropdown, select one or more customers.
5. Click Add.
6. Click Save (top right of the page).
The customers appear under Assigned customers, and the policy is applied to their devices.
Assign a Configuration Policy to a Folder
Assigning a configuration policy to a folder overrides the site's policy for that folder, and applies to every agent in the folder that doesn't have its own policy. You can assign one policy per folder.
Assigning a configuration policy to a folder overrides the customer's policy for that folder, and applies to every agent in the folder that doesn't have its own policy. You can assign one policy per folder.
To assign a policy to a folder:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy (or create a new one).
3. Click the Assignment tab.
4. From the first dropdown, select the site.
4. From the first dropdown, select the customer.
5. From the folder dropdown, select one or more folders.
6. Click Add.
7. Click Save (top right of the page).
The folders appear under Assigned folders, and the policy is applied to their devices.
Assign a Configuration Policy to a Dynamic Group
Assigning a configuration policy to a dynamic group applies it to every device in the group, now and when devices join later. A dynamic group carries one configuration policy at a time. If a device is in more than one dynamic group and the groups have different policies, the most recently edited policy applies. Configuration policies apply to Windows devices only, and Windows Home editions are not supported. Other devices in the group aren't affected. To create a group first, see Dynamic Groups
To assign a policy to a dynamic group:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy (or create a new one).
3. Click the Assignment tab, then click the Groups tab.
4. From the Assign to groups dropdown, select one or more groups.
5. Click Add.
6. Click Save (top right of the page).
The groups appear under Assigned groups, and the policy is applied to their devices.
Assign a Configuration Policy to an Agent
Assigning a configuration policy directly to an agent overrides any policy the device inherits from its dynamic groups, folder, or site. You can assign one policy per agent. Technicians without full admin access can use this method if their role has access to the device's site.
Assigning a configuration policy directly to an agent overrides any policy the device inherits from its dynamic groups, folder, or customer. You can assign one policy per agent. Technicians without full admin access can use this method if their role has access to the device's customer.
To assign a policy to an agent:
1. From Devices (on the sidebar), select the device.
The Agent Console appears.
2. In the Profiles widget, click the edit icon () next to Configuration policy.
The Assign configuration policy window appears.
3. Select a policy from the dropdown, then click Apply.
The policy is assigned to the device and shown next to Configuration policy in the Profiles widget.
Tip: To check which policy applies to the device and where it comes from, look at the Source column in the Assign configuration policy window. A policy marked Overridden by a higher priority profile is not applied, because a more specific policy is assigned.
Configuration Policy Assignment Methods That Aren't Supported
Configuration policies can only be assigned to sites, folders, dynamic groups, and individual agents, using the steps above. The following aren't currently supported:
Configuration policies can only be assigned to customers, folders, dynamic groups, and individual agents, using the steps above. The following aren't currently supported:
- Bulk assignment through the API: There is no API endpoint for assigning configuration policies.
- More than one policy per site, folder, dynamic group, or agent: To apply several configurations to the same devices, include them all in one policy.
- More than one policy per customer, folder, dynamic group, or agent: To apply several configurations to the same devices, include them all in one policy.
Edit a Configuration Policy
You can change a configuration policy's name, description, and settings. Changes apply to every site, folder, dynamic group, and agent the policy is assigned to.
You can change a configuration policy's name, description, and settings. Changes apply to every customer, folder, dynamic group, and agent the policy is assigned to.
To edit a configuration policy:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy.
3. Click the name or description field to edit it, or change the configuration settings.
4. Click Save (top right of the page).
The policy is updated, and the change is recorded in Admin > Users and security > Audit log.
Unassign a Configuration Policy
Warning: Unassigning a configuration policy doesn't revert the settings it applied. Devices keep the last settings they received. To return devices to their own Windows settings first, set the policy's configurations to Revert to device settings, save, and wait for the policy to be enforced (up to 12 hours) before unassigning it.
Site, folder, and dynamic group assignments are removed inside the policy. Agent assignments are removed from the device's Agent Console.
Customer, folder, and dynamic group assignments are removed inside the policy. Agent assignments are removed from the device's Agent Console.
Unassign a Configuration Policy from a Site or Folder
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy.
3. On the Assignment tab, hover over the assigned site or folder and click the remove icon ().
4. Click Save (top right of the page).
The site or folder no longer uses this policy. Its devices fall back to a less specific policy (for a folder, the site's policy), if one is assigned.
Unassign a Configuration Policy from a Customer or Folder
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy.
3. On the Assignment tab, hover over the assigned customer or folder and click the remove icon ().
4. Click Save (top right of the page).
The customer or folder no longer uses this policy. Its devices fall back to a less specific policy (for a folder, the customer's policy), if one is assigned.
Unassign a Configuration Policy from a Dynamic Group
To unassign a policy from a dynamic group:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Select the policy.
3. On the Assignment tab, click the Groups tab.
4. Hover over the assigned group and click the remove icon (trash can).
5. Click Save (top right of the page).
The group no longer uses this policy. Its devices fall back to the next policy that applies to them, if one is assigned.
Unassign a Configuration Policy from an Agent
1. From Devices (on the sidebar), select the device.
The Agent Console appears.
2. In the Profiles widget, click the edit icon () next to Configuration policy.
The Assign configuration policy window appears.
3. Click the x next to the policy name, then click Apply.
The message Configuration policy removed appears, and the policy is removed from the agent. The device falls back to its dynamic group, folder, or site policy, if one is assigned.
The message Configuration policy removed appears, and the policy is removed from the agent. The device falls back to its dynamic group, folder, or customer policy, if one is assigned.
Delete a Configuration Policy
Warning: Deleting a configuration policy removes it from every site, folder, dynamic group, and agent it's assigned to, but doesn't revert the settings it applied. To return devices to their own Windows settings first, set the policy's configurations to Revert to device settings and wait for enforcement before deleting the policy.
Warning: Deleting a configuration policy removes it from every customer, folder, dynamic group, and agent it's assigned to, but doesn't revert the settings it applied. To return devices to their own Windows settings first, set the policy's configurations to Revert to device settings and wait for enforcement before deleting the policy.
To delete a configuration policy:
1. Go to Admin > Monitoring and automation > Configuration policies.
2. Next to the policy, click Actions, then select Delete.
The policy is deleted and removed from all assignments.
