Skip to content
MoftgateMoftgate Docs
Product guide

Users & Groups

Manage device users and the groups, tags, and profiles used as targets in policies and automations.

What Users and Groups Are#

Users and groups answer two different questions. Users tell you who is on a device. Groups tell you which devices a policy applies to. Both are needed before any policy can be targeted precisely.

Getting this model right is what keeps the rest of the platform manageable. A policy that targets a well-designed group needs no maintenance; a policy that targets a long static list needs constant attention.

User directory, device sessions, and real-time resource consumption.
Endpoint user intelligence screen
Close image

Device Users#

  • Local accounts on the endpoint, collected by the agent from the operating system.
  • The current interactive user, read separately from the agent service account.
  • Recent sign-in activity, used to attribute telemetry and incidents to a person.
  • Administrative rights held by each account, which is a common source of security findings.
User attribution matters
Because the agent runs as a service, it can report the interactive user even when the user has no administrative rights. This keeps incident attribution accurate.

Groups#

Selection typeWhen to use it
Static groupA fixed list of endpoints. Use it when membership changes rarely and must be controlled manually.
Dynamic groupMembership is calculated from a rule, so a new endpoint that matches the rule joins automatically.
TagA lightweight label used for cross-cutting selection, such as a project, a department, or a risk class.
ProfileA configuration template applied to endpoints; it also acts as a selection target for policies.

Targeting#

Every policy, monitor, automation, and script asks for a target. The target is always expressed as groups, profiles, tags, or individual endpoints - never as a free-text device name.

  1. 1
    Model the organisation

    Create groups that match how your teams and sites are actually organised, not how an asset database happens to be structured.

  2. 2
    Prefer rules over lists

    Use a dynamic rule when membership can be expressed as a condition. Static lists age badly because nobody remembers to update them.

  3. 3
    Add tags for cross-cutting cases

    Use tags for selections that cut across groups, such as a migration project or a temporary exception.

  4. 4
    Target policies by group

    Apply policies and automations to a group, profile, or tag. Target selection always resolves to a set of endpoints, never to a single ambiguous name.

Frequently Asked Questions#

What is the difference between a device user and a platform user?
A device user is an account on a managed endpoint, collected by the agent. A platform user is someone who signs in to the Moftgate interface. They are separate records with separate permissions.
How is the current operating system user determined?
The agent runs as a system service, so it reads the interactive operating system user separately from its own service account. This is what makes user attribution correct in telemetry and incidents.
Can a policy target a single endpoint?
Yes. Target selection supports groups, profiles, tags, and individual endpoints. Use a single endpoint for a pilot, and a group for anything permanent.
What happens to a group when an endpoint is removed?
The endpoint leaves every group and stops matching dynamic rules. Policies that target the group simply no longer include it.