Before creating and applying tags, it's important to understand the different types of tags available.

Transcription

1 Types of Tags in Systems Manager Before creating and applying tags, it's important to understand the different types of tags available. Note: For information on using and configuring tags in Systems Manager, refer to this article. Device Tags Manual - Simple admin generated tags that are applied statically to devices. These are labeled when scoping simply as "Tags". Must be manually added/removed, and are always active. Device type - These are automatically generated and assigned to devices by Dashboard based on operating system. Listed under "Auto tags" on client pages. Policy Tags Most tags are considered static, meaning the tag remains unchanged unless it is modified or removed by a Dashboard Admin. Policy tags are considered dynamic, as they can automatically change themselves into one of two binary states (i.e. compliant or violating, within hours or after hours). This allows you to gate settings or applications on devices meeting certain criteria, for example pushing work materials only during work hours, or only to devices that are within school location bounds. Continue reading below, or check the profile example. 1

2 Security policy - For each policy configured in Dashboard, devices are either compliant or violating, and will automatically be labeled with the corresponding tag. These are set under Configure > Policies. For more information, refer to the article on security policies. Geofencing - These dynamic tags are automatically assigned to devices depending if they are within a designated physical boundary, such as a campus or office location. These are set under Configure > Geofencing. For more information, refer to the article on Geofencing. Schedule - Only active during scheduled periods. Also known as time-based tags. Configured under Configure > General. User Tags 2

3 Active Directory - Another example of dynamic tags. If you configure enrollment authentication with AD or Merakihosted accounts, Systems Manager can use your existing AD organization units as tags. During enrollment, users will authenticate their device and automatically have owner or AD groups applied as tags to that device. This allows you to scope by user role, like 'Administrators', instead of manually marking each device or owner as an administrator. Owner Tags - Similar to manual device tags, except these are applied directly to owners under Configure > Owners. These can be used to scope by individual, or by role. For example, if 'Patrick' owns multiple devices, or multiple devices belonging to people labeled 'sales', it may be easier to scope by owner tag instead of device tag. Time-based tags can be used with Systems Manager (MDM) to dynamically add and remove profiles from devices based on defined time periods. This can be very useful if profiles should only be present on devices during particular times, such as during business hours. This article will discuss how to create time-based tags and how they operate. For information on applying tags, such as time-based ones, to profiles, please reference the article on Using and Applying Tags in Systems Manager. Note: Time-based tags are only available for Systems Manager Enterprise customers. Time-Based Tags Time-based tags apply to all client devices in the network they are configured for. When within the time bounds defined for the tag, it will be active as an Auto tag for any clients. This can then be used in conjunction with profiles. 3

4 As with any other changes to profiles and clients, for the change to go into effect, the client must be reachable to Systems Manager. Thus a profile dependent on a time-based tag that goes inactive at 15:00 may not actually be removed until some time later when the client is reachable. Likewise, a profile dependent on a tag going active at 08:00 may not be applied until 10:00 if that is the first time the client is reachable after 08:00. In the example configuration below, two tags are configured: business_hours - Active on Mon-Fri, from 8am-5pm each day. weekend_shift - Active Sat and Sun, from 7am-7am each day. Creating Time-Based Tags 1. Navigate to Configure > General. 2. Under the Time based tags section, click Add a new tag. If any tags already exist, this link will be at the bottom of the list. 4

5 3. Enter a Tag name that describes the time period and will be displayed on relevant profiles and devices. 4. Select a Start time that indicates when a tag should be active on each selected day. 5. Select an End time that indicates when a tag should go inactive on each selected day. Note: This must be greater than the Start time. 6. Check the box next to any Days of the week that the tag should be active, within the bounds of the Start and End times. 7. Click Save Changes. When this tag is active, it will be listed under Auto tags for clients in the network. Removing Time-Based Tags 1. Navigate to Configure > General. 2. Under the Time based tags section, find the tag that should be removed. 3. Click the X on the far right of the tag configuration, under the Remove column. 4. Click Save Changes. 5