---
title: "Using Assignment Rules"
slug: "using-assignment-rules"
updated: 2025-07-22T16:38:06Z
published: 2025-07-22T16:38:06Z
canonical: "support.kandji.io/using-assignment-rules"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt
> Use this file to discover all available pages before exploring further.

# Using Assignment Rules

As of April 9, 2025, Classic Blueprints are deprecated—effective immediately for new customers and taking effect for existing ones. While it’ll no longer be possible to create new Classic Blueprints, existing ones will continue to function and be supported until the end of the calendar year 2025. For more information, check out our [Product Updates page](https://www.kandji.io/updates/2025/04/classic-blueprints-deprecation/).

### What are Assignment Rules?

As of September 18, 2024, Library Item Assignment Rules for use with Classic Blueprints are considered deprecated, but remain functional and are supported for customers with existing configured rules.

Assignment rules let you configure devices by applying specific settings and software to select groups using conditional blocks within an Assignment Map. This feature offers flexibility and control, ensuring the right configurations are applied to the appropriate devices.

### How do Assignment Rules work?

Assignment rules allow a Kandji administrator to apply different device configurations based on specific conditions. These conditions can be determined by device attributes, user attributes, or other criteria from integrated identity providers like Okta, Google Workspace, OneLogin, or Microsoft Entra ID. For more details on setting up assignment rules in conditional blocks within an Assignment Map, please refer to our [Using Conditional Logic in Assignment Maps](/v1/docs/advanced-assignment-maps-configuration) support article.

### Building Assignment Rules

> [!NOTE]
> Compatibility checks take precedence over Assignment Rules. For instance, if you have a Library Item that requires macOS 14 or later, it will be marked as Incompatible on devices running anything below macOS 14.

Assignment Rules are comprised of the following components:

- **Input -** An attribute that will be compared when evaluating a rule. For example, a device's *chip type.*
- **Operator -** The method of comparison used when evaluating a rule. For example, *Is* or *Is Not*.
- **Value -** The specific data that the input will be compared to when evaluating a rule. For example, *Intel* or *Apple silicon*.

A completed rule might look like this:

- **Input:** Chip type
- **Operator:** Is
- **Value:** Apple silicon

This rule would ensure that the Library Item is installed only on Macs with Apple silicon.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/lux_klqGsEQB1Og2kx_wcX6TRxIlhGQlfg.png)

#### Supported Inputs, Operators, and Values

Assignment Rules support the following inputs, operators, and values.

| Input | Operators | Example Values |
| --- | --- | --- |
| Enrollment Type | is is not | Automated Device Enrollment Manual Device Enrollment |
| Chip type | is | Apple Silicon Intel |
| FileVault | is | On Off |
| Supervision status | is | Supervised Not Supervised |
| Mac family | is one of is not one of | iMac iMac Pro Mac Pro MacBook MacBook Pro MacBook Air Mac mini Mac Studio |
| [Tags](/v1/docs/tags-for-devices) | are exactly are not exactly contain one of does not contain one of | Test Pilot Production |
| Asset Tag | is is not is one of is not one of contains does not contain contains one of does not contain one of | Honolulu 123987 DEN-123845-MBP |
| Serial Number | is is not is one of is not one of contains does not contain contains one of does not contain one of | QCM2XXXXXX |
| OS version | is is not is greater than is less than is greater than or equal to is less than or equal to is between | 12 13.1 16.2.2 |
| User Email | is is not is one of is not one of contains does not contain contains one of does not contain one of | admin@accuhive.io |
| User Group | is one of is not one of | database-admins |
| User Job Title | is is not is one of is not one of contains does not contain contains one of does not contain one of | Product Engineer |
| User Department | is is not is one of is not one of contains does not contain contains one of does not contain one of | Product |

### Combining Rules into Rulesets

You can combine multiple rules into rulesets, which are evaluated together. Rules in a ruleset are combined using an AND logical operator, meaning all conditions must be met for the rule to apply. Some inputs allow multiple values, which are combined using an OR logical operator.

A completed ruleset might look like this:

| - **Input:** Chip type - **Operator:** Is - **Value:** Apple silicon | - **Input:** Mac family - **Operator:** Is one of - **Value:** MacBook, MacBook Pro, MacBook Air |
| --- | --- |

This ruleset would install the Library Item if the device is a Mac with Apple silicon and either a MacBook Pro or a MacBook Air.

![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/z62OsTlObfDvY0fibnYoHM54wTIHFxeEWQ.png)

### Other Considerations

- For User Group, Mac Family, User Job Title, and User Department, when providing multiple input values for the criteria, these will be treated as an "OR" operator between the values.
  - For example, if you set "user group" to "is one of" with the values of "finance users" and "engineer users," a user will only need to be in one of these groups for the rule to evaluate true.
- The User Group option allows for auto-complete of known groups.
- Job Titles and Departments must be typed in full.
  - To enter multiple Job Titles, Departments, Serial Numbers or Asset Tags, press enter, and the current text input will become a chip so that more can be added, or you can paste a newline-separated list into the box, and each value will automatically become a chip.
- Assignment Rules based on User Group assignment will be evaluated at the next daily check-in. For more information about device check-in, see the following support articles:
  - [macOS Check-In](/v1/docs/macos-check-in)
  - [iOS, iPad OS, & tvOS Check-In](/v1/docs/ios-ipad-os-tvos-check-in)

#### Device Family Assignment

- The device family assignment (**Install on** selector) allows you to define specific device families that a library item should be installed on.
  - Example: This can be leveraged to install a multi-platform Apps and Books app, such as Okta Verify, to a single device family.
- The **Install on** field will show only compatible device families.
  - Example: If an app store app is only compatible with macOS, you cannot select iPhone from the device family selector.
- Additionally, selecting or excluding a specific device family will change the Assignment Rules available to you.
  - Example: Removing Mac would disable the macOS option within the OS Version rule.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1259PM@2x.png)

### Library Item Assignment Rules within Classic Blueprints

#### Adding Assignment Rules to a Library Item

If a Library Item supports Assignment Rules, you can add them by editing the Library Item.

1. Select or create a **Library Item**.
2. Assign the Library Item to the **Classic Blueprint** to which you want the Rules to apply.
3. In the Rules section under Assignment, click **Add**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/c3ozpnu8021jrj0ndf3rx41num4oh9j9bw.png)
4. Choose the input type from the **Select input** menu.
5. Select the **operator** (i.e., Is, Is Not, Contains).
6. Provide the necessary **value(s)**.
7. Optionally, add more rules by clicking **Add rule**.
8. Click Confirm to save the rule. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/tmz_hp8miylvb4atcwbm7pq6j4nfvqmmpw.png)

#### Viewing Assignment Rules for a Library Item

You can view Assignment Rules for a Library Item in several ways:

- In the Library, the item will show an Assignment Rules glimpse.
- In the Classic Blueprint, the item will display the number of rules and their details.
- In the Device Status view, the Assignment Rules glimpse indicates whether the item is pending, installed, or in an error state

#### Editing Assignment Rules

To edit existing rules, perform the following steps:

1. Select the Library Item, and click **Edit** in the lower right-hand corner.
2. Click **Edit** in the Rules section.
3. Make the necessary changes, and click **Confirm**.![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/WVw8gdOTxKG8XMnI_wN5zv2BCy_ovjIl1w.png)

#### Considerations when Editing Assignment Rules

The following actions can be taken when editing Assignment Rules:

- Add a Rule - each input can only be specified once
- Change Inputs
- Change Operators
- Change Values
- Delete an individual rule - you cannot delete the last rule this way; instead, delete an entire set of Assignment Rules

#### Delete an Entire Set of Assignment Rules

You can delete an entire set of Assignment Rules from a Library Item. This will cause the Library Item to be installed on all devices in all assigned Blueprints the next time each device checks in.

1. Select the Library Item, and click **Edit** in the lower right-hand corner.
2. Click **Remove** in the Rules section.
3. Click **Remove** again in the warning dialog.
4. Click **Save** to save the Library Item without any Assignment Rules. ![zsRvb1GvbOJqV9mKL0cc9BpFmwkwlZfOYw](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/97burpipe_d6fdbfabjg5itpq8f4xzfdjw.png)

#### Library Item Support

The following library items currently support assignment rules:

| Auto Apps | Energy Saver | Screensaver |
| --- | --- | --- |
| App Store apps | FileVault | Single Sign-On Extension |
| Airplay Security | Firewall | Software Update |
| AirPrint | Gatekeeper | SSH |
| App Lock | Kernel Extension | System Extension |
| App Store | Login & Background Items | System Preferences Panes |
| Certificate | Login Window | VPN |
| Conference Room Display | Managed Data Flow | Wallpaper |
| Custom App | Media Access | Wi-Fi |
| Custom Script | Passcode |  |
| Custom Printer | Privacy |  |
| Custom Profile | Recovery Password |  |
| Device Name | Restrictions |  |