Assignments
See which policies, apps and scripts apply to a user, a device or a group, and read the reason behind every result.
The Assignments page answers "what applies here, and why?" for a user, a device or a group. Open Assignments in the sidebar. The page reads the assignments, group memberships and assignment filters Kairavo has collected. It never changes anything in your tenant.
Look up what applies
Open the Lookup tab.
Choose what to look up:
- User: everything assigned to a user.
- Device: everything assigned to a device. This is the default.
- User on a device: the combined result for a user signed in on a specific device.
- Group: everything assigned to a group.
Start typing in the field and pick a match. Search users by name or object id, devices by device name or serial number, and groups by group name or object id.
Optional: open More options and pick a date in As of to see the result at a past date. The earliest date is the start of the collected history. Select Show current to return to today.
The result starts with a summary line, for example "12 apply · 2 excluded · 1 unknown". Below it, the results are grouped into Policies, Apps and Scripts. Each row shows the Name, the Type, the Result and Why.
The Result is one of:
| Result | Meaning |
|---|---|
| Applies | At least one include reaches the subject and no exclusion does. |
| Excluded | An exclusion reaches the subject. Exclusions win over includes. |
| Unknown | The collected data cannot decide. See Unknown results. |
| Not targeted | No include reaches the subject. |
| Other platform | The policy is for another platform than the device. |
Read the reason chain
Click the text in the Why column to open the reason chain. It has one line per assignment target of that policy, app or script.
Each line shows:
- Include or Exclusion: the role of the target.
- The target, such as a group name, All users or All devices.
- How it matched the subject:
- "Member through the device" or "Member through the user", followed by direct or direct or nested. A member of a nested group counts as a member of the parent group.
- Every user or Every device for All users and All devices targets.
- Not a member or Membership unknown.
- The assignment filter, if there is one, with its mode and whether the device matches: match, no match, unknown or not evaluated.
- The app intent, such as required or available, when Kairavo collected it.
- The effect of the line: Includes, Excludes, No effect or Unknown.
The line that decides the result carries the Decides badge. A short sentence under each line explains it in plain words.
The chain follows these rules:
- Exclusions win. If any exclusion reaches the subject, the result is Excluded, whatever the includes say.
- Nested groups count. A device or user that is a member through a nested group is a member.
- Devices reach through their primary user. A group assignment reaches a device when the device or its primary user is a member.
- All users reaches every user and every device with a primary user. All devices reaches every device.
- Assignment filters narrow a target. An include filter keeps the devices that match its rule. An exclude filter removes them.
Filters are evaluated on each device. When you look up a user or a group without a device, filter lines show not evaluated. Use User on a device to see the filter result for one device.
Unknown results
Kairavo shows Unknown instead of guessing when the collected data cannot decide. The reason chain says why. Common reasons:
- The group's latest membership read is too old or failed.
- The device has no collected Entra device id, or its primary user is not collected.
- The assignment filter is not collected, its rule could not be parsed, or it reads a device property that Kairavo does not collect.
- The filter is a managed app filter. These are not evaluated.
- The assignment is a macOS shell script group assignment. These assignments do not record whether the group is included or excluded.
When an include applies but an exclusion group's membership is unknown, the result is also Unknown, because the exclusion might win.
For a Group lookup, Kairavo lists the group's own assignments and All users or All devices targets that reach its members. Assignments to groups that contain this group are not listed, because the collected data does not show which groups contain it.
The other tabs
- Simulate: see what a user or device gains or loses if it joins or leaves a group. Nothing is changed in the tenant.
- Compare groups: put the assignments of two to four groups side by side, with shared and different assignments marked.
- Hygiene: find unassigned policies, apps and scripts, assignments to All users or All devices, empty groups that assignments still reference, and assignments that use filters.
- Filter test: pick an assignment filter and a device to evaluate the filter rule against the device's collected properties, clause by clause.