Machine Groups
A Machine Group names a set of machines, Assets and Clients alike, so that a Policy can target all of them at once instead of listing each one. You find them in the Admin Console under Definitions → Machine Groups.
Machine Groups serve two purposes:
Offering one service on many Assets. Group Assets that provide the same service and offer it once on the group, instead of adding every Asset with its service to each policy. Examples:
- All file servers, offered on SMB: a policy grants access to every file server at once, and a new file server joins the group via its tag or operating system without anyone editing the policies.
- All Linux servers, offered on SSH for your administrators.
Reaching Clients. Besides Assets, Virtual Assets and Subnets, a policy can lead to a Machine Group, and with it to the laptops and desktops of your users (their Clients). Examples:
- Remote support: your helpdesk reaches every employee laptop via Remote Desktop, SSH or a remote-support tool, without a separate remote-access product.
- Reaching your own devices: users connect from their laptop to their desktop in the office, wherever they are.
- Machine-to-machine access: a management server (e.g. software deployment or inventory) reaches all Windows clients, whether or not anyone is signed in on them.
Kinds of Machine Groups
Static
A static group contains exactly the machines you pick. Use it for a fixed set, e.g. the two build servers of a team.
Dynamic
A dynamic group contains every machine matching its Selectors, and keeps itself up to date as machines are added, retagged or change their users:
- Machine kind: Assets + Clients (the default), Assets only or Clients only
- Operating system, e.g. all Windows machines
- Machine tags, the tags you set on Assets and Clients
- User groups, machines on which a member of one of these user groups is signed in
Selectors combine with OR inside one selector and AND across selectors. A group with the tags Sales and Marketing and the operating system Windows contains every Windows machine carrying either tag, Assets and Clients alike. Set Machine kind to Assets only to keep the Windows laptops out and select only the servers.
A dynamic group needs at least one selector. Machine kind counts as one, so a group with only Assets only set contains every Asset in the tenant, the counterpart of the built-in All Clients.
Built-in groups
Every tenant has two built-in groups. They cannot be edited or deleted.
| Group | Contains | Use as |
|---|---|---|
| All Clients | every Client in the tenant | destination, e.g. helpdesk access to all laptops |
| Own Clients | the Clients of the user who is accessing | destination, so every user reaches their own other devices |
Both built-in groups are destinations only. Own Clients depends on who is accessing, so naming it as a source would be circular. All Clients cannot be a source either.
If you need every Client as a source, create a dynamic group with the Machine kind Clients only and no other selector. It contains the same machines and works on both sides of a policy.
Services
A group declares the services it offers (e.g. RDP, SSH) on its Access tab. A policy reaches the group on one of these services, just as a policy reaches an Asset on one of its services. A group that offers no service cannot be used as a destination. The built-in groups can be combined with any service.
On the same Access tab you can add the group to existing policies directly, without opening each policy.
Machine Groups in Policies
As destination
A machine group as Policy destination grants the policy's sources access to every machine in the group on the chosen service. When a machine joins or leaves a dynamic group, its access changes with it, with no need to edit the policy.
A Client is reachable whenever it is online, also when nobody is signed in on it.
As source
Static and dynamic groups can be sources; the built-in groups cannot, see Built-in groups.
A machine group as source grants access to the machine, independently of who is signed in on it. This is the difference to a User Group source:
| Source | Access applies |
|---|---|
| User Group | only while a member of the group is signed in on the Client (or before sign-in, with Pre-authentication Access) |
| Machine Group or Asset | always, whoever is signed in, including nobody |
Use a user group when access belongs to a person, and a machine group when it belongs to the device, e.g. a monitoring or deployment agent running on it.
Requirements for reaching a Client
- The Client must run agent version 1.132 or later. Older agents keep their connections but do not open their firewall for incoming access.
- The service must be enabled and allowed on the device itself. For Remote Desktop on Windows, for example, Remote Desktop must be turned on in the Windows settings (not available on Windows Home editions).
- A Client is reachable under its host name, like an Asset.
Example: Helpdesk access to all laptops
- Create a user group Helpdesk (or import it from your identity provider).
- Create a policy with the source Helpdesk and the destination All Clients on the service RDP.
Members of Helpdesk can now connect via Remote Desktop to every laptop, using its host name, as long as they are signed in to XplicitTrust.
To reach only the Windows laptops, create a dynamic group under Definitions → Machine Groups with the Machine kind Clients only and the operating system Windows, offer RDP on its Access tab, and use it as the destination instead of All Clients.
Example: Access to all file servers
- Tag your file servers (Assets) with Fileserver.
- Under Definitions → Machine Groups, create a dynamic group File servers with the Machine kind Assets only and the tag Fileserver.
- On the group's Access tab, offer the service SMB, and add the group to the policy granting your employees access to file shares.
Every Asset you tag Fileserver later is reachable through this policy right away, without changing it.
A single Client
To target one device, create a static group containing only that device.