Policy membership recalculation

This topic discusses the logic that determines how policy memberships get recalculated.

Target your device

For a policy to be applied to a device, the device needs to be part of a filter or a group that the policy targets. To learn how to add a device to a filter or a group, refer to Device Filters and Groups.

When do policies get refreshed?

  • Every 24 hours, at midnight in your time zone.

NOTE  If you click Save and Deploy Later instead of Save and Deploy Now when creating or updating a policy, the changes will still be deployed at midnight in your time zone because policies are automatically deployed every 24 hours.

  • On Agent startup for Agent policies, Patch Management policies, Windows Update policies, and Power policies.
  • Immediately after a policy is deployed.
  • Every few minutes if a "reassigned" flag had been set on the device.

Policies get recalculated every 24 hours, at midnight in your time zone. If any device has been added to or removed from the policy, the new associations will automatically be applied at midnight.

You can expedite this process by disabling and then enabling the policy and deploying the changes. This will update the policy memberships immediately. For more information on how to do this, refer to Enabling or disabling the policy, sites, or devices.

If a device is offline during the nightly refresh or at the time of policy deployment, an additional check is performed at Agent startup to ensure that the Agent has the latest policies applied when connecting to the platform. This only applies to Agent policies, Patch Management policies, Windows Update policies, and Power policies.

If you add a new device to your account, move a device to another site, or update the device's group membership, the device will be flagged as reassigned. A job that runs every few minutes will see this flag and perform some basic policy recalculation for the device. The basic policy recalculation is not a full policy refresh, however, it can do the following:

  • Remove any site policies that the device had.

    • NOTE  Global policies are not removed when the "reassigned" flag is detected, unless that global policy was created by a user with no access to the site the device was moved to. Refer to Scope.

  • Add all site and global policies to the device where it is part of the filter or the group that the policy targets.