Distribute User-Based Policies

Introduction

In Relution, policies are assigned to device groups by default. However, with dynamic device groups and user-based filtering, policies can also be specifically linked to an individual user or an entire user group.

The principle works as follows:

  1. A dynamic device group is configured with a user filter.
  2. As soon as the corresponding user (or a member of the user group) signs in on a device, the device is automatically moved into this device group.
  3. The policies assigned to the device group become active and are applied to the device.
  4. When the user signs out, the device leaves the group again – the policies are deactivated.

Requirements

  • Users are created in Relution and, if necessary, assigned to a user group
  • Devices are enrolled and can be assigned to a user
  • Sufficient administrator permissions in the respective organization

Use Cases

ScenarioFilter TypeDescription
Individual user receives a special policyUsere.g. developer needs relaxed restrictions, private Exchange profile
Department receives a standardized configurationUser Groupe.g. all teachers receive a shared Exchange profile
BYOD scenarioUser GroupWork profile policies only for registered BYOD users

Create a Dynamic Device Group

For an Individual User

  1. Navigate to Devices → Device Groups.
  2. Click New Device Group.
  3. Enter a meaningful name, e.g. DYN – John Smith.
  4. Select Dynamic as the type.
  5. Under Filter, add the following condition:
    • Filter Type: User
    • Value: Select the desired user from the list
  6. Save the device group.

Screenshot

Note: If the user is signed in on multiple devices at the same time, all affected devices will be added to the group.

For a User Group

  1. Navigate to Devices → Device Groups.
  2. Click New Device Group.
  3. Enter a meaningful name, e.g. DYN – Teachers.
  4. Select Dynamic as the type.
  5. Under Filter, add the following condition:
    • Filter Type: Group
    • Value: Select the desired user group from the list
  6. Save the device group.

Tip: User groups can be synchronized via LDAP/AD. Changes to group membership in LDAP are automatically transferred to Relution.

Assign Policies to the Dynamic Device Group

After creating the dynamic device group, assign the desired policies to it:

  1. Open the newly created device group.
  2. Switch to the Policies tab.
  3. Click Add Policy.
  4. Select one or more policies and confirm.

The policies are now linked to the dynamic device group and will be applied automatically as soon as a device meets the filter condition.

Recommendations and Best Practices

  • Naming Convention: Use a consistent prefix for dynamic device groups, e.g. DYN –, to clearly distinguish them from static groups.
  • Policy Priority: Watch for possible conflicts if a device is a member of multiple dynamic groups at the same time.
  • Testing: Test new dynamic groups first with a single test device and test user before deploying them in production.
  • LDAP Synchronization: If using LDAP groups, check whether the synchronization intervals fit your use case.