Entra Policy Suite settings · Settings > Device tagging
Device tagging
| Key | DeviceTagging.Enabled |
|---|---|
| Where | Settings > Device tagging |
| Type | On / off |
| Default | Off |
| Feature | Device tagging · Community |
| Confirmation | Entra Policy Suite asks you to confirm before it is switched on. |
What it does
Switches the device tagging feature on: the job that evaluates the device rules and writes each device's tags to its extension attributes in Entra ID.
When enabled
The scheduler starts the job at its schedule; 'Device tagging mode' decides between Preview and Apply. Run now from the Jobs page works too.
When disabled
Off (the default): no scheduled run, and Run now requests for device tagging are refused. Tags already written stay.
Risk and how to reverse it
Device tags can drive Conditional Access device filters, so a wrong rule changes which devices a policy covers. The mass-change guard holds unusually large runs. Reversible: switch it off; written tags stay.
Requires
Admin. The engine identity's Graph right to write device extension attributes (given by the install).
Recommended
On, with the mode on Preview first.
Related settings
- Device tagging mode (scheduled runs) DeviceTagging.Mode
- Also tag a device at once when it changes DeviceTagging.RunOnDirectoryChange
- Never tag these devices DeviceTagging.ExcludeObjects
Documented for Entra Policy Suite 2.0.107. Written by the Entra Policy Suite team; Invardia publishes it. · All settings · Security review pack