Device tagging
Every device gets its category - privileged access workstation, corporate Windows, kiosk, corporate or personal phone - from your device rules.
Purpose
Device filters in Conditional Access and device-based dynamic groups need a reliable device category. Operating system and ownership alone do not say which machines are privileged access workstations or kiosks.
Design
The device tagging job evaluates the device rules - 36 device condition types, from display name and enrollment profile to trust type, ownership, compliance and operating system - and writes the result to the device's extension attribute in Entra ID, in Preview or Apply mode like user tagging.
Business opportunities
Device-based policies and groups target the right machines, and a new device is categorized by the next run.
Related features
Rules you edit like a spreadsheet
Every tagging rule on one page, edited like Excel: select, copy and paste, fill down, duplicate, move and switch on or off - many rules at once.
User tagging
Every user gets its tags from your rules - cloud users in Entra ID, AD-synced users in Active Directory.
A hybrid worker for Active Directory
Tags of AD-synced users are written in Active Directory by a small worker that only connects out and has no password.
Jobs on your schedule
Every job runs on the schedule you set - daily, weekly or every few hours - with Preview and Apply on demand.