Best Practices for Building Assignment Maps

By Emalee Firestein

Assignment Maps are infinitely flexible and can adapt to almost any deployment scenario. However, with great flexibility can come added complexity. To that end, Kandji recommends some best practices when building Assignment Maps.

Group Like Conditions

Group similar conditions together in the same Conditional Block using additional “else if” nodes if possible, versus making additional Conditional Blocks. Take this example:

Because both of these Conditional Blocks connect to the root line, someone in marketing would get Pages, and someone in sales would get Keynote. When evaluating the rules, the “else” condition would be met when evaluating false. So while this works, a more efficient way to accomplish the same evaluation, and generate a cleaner map, would be to use a single conditional block:

First-Match Basis

Conditional Blocks are evaluated on a first-match basis, meaning that once a condition is matched, the evaluation moves on to the next block. Therefore, avoid grouping unlike conditions to ensure evaluations meant to occur are not skipped. For example, to target Apple silicon Mac computers in marketing, do something like the following:

Or, even better, something like this for a more reusable graph, where the conditions for Marketing and Apple silicon are nested but not tied together. This would allow assigning Library Items to all of Marketing and still only a subset to Marketing users with Apple silicon Mac computers.

Do not try to do something like this. When the rule for marketing is evaluated as true, the rule for Chip type will never be tested, and the device will not collect the Pages Library Item.

Map Least-Specific to Most-Specific

Assignment Maps are evaluated left to right, and self-conflicting Library Items, like Managed OS, will always be assigned based on what is “most specific”. On an Assignment Map, “most specific” means the farthest right on the map.

A common example of this may be a “global” Managed OS setting that enforces updates within 2 weeks of release by Apple. But then a smaller subset in a testing cohort (identified in this example by asset tags containing “TEST-”) may be enforced within 2 days. On an Assignment Map, this would look like:

Devices with an asset tag containing “TEST-” would be forced to update within 2 days instead of the normal 2 weeks, which is scoped to All Devices. All Devices still respects the Installs On field of the Library Item and/or inherent compatibility included in Kandji, so non-Mac devices would, correctly, not receive either of the above Library Items.

Be Mindful of Attributes with Single Values

When nesting conditional blocks, be mindful of user attributes that can only have a singular value. For example, a user department is singular, meaning it will only match one condition. Take the following incorrect example, where the desire was to apply some apps and settings to all users in R&D, and then some specific ones to only Engineering:

Instead of user department, the second condition (and possibly the first), should have instead used the user group… is one of facet. This is because there is no user where the department can be both R&D and Engineering; it would only ever be one or the other. If user group was used instead, both could easily be matched and true, as a user can be in more than one group.

No Need to Branch Based on Device Family

Assignment Maps respect the Installs On setting configured at the Library Item level all throughout the map. This means that you don’t have to duplicate logic across multiple branches on a map for a single use case, just because of device family. For example, if there are apps for Marketing that vary based on device family, you can make a single Assignment Node for Marketing and assign all Mac and iPad Library items to it, and Assignment Maps will ensure only the applicable Library Items are assigned to the applicable device families.

Assignment Maps also respect the inherent compatibility checks built into some Kandji-provided Library Items like Managed OS and Auto Apps.

If you still have a workflow in mind where you’d like to be able to create a branch based on device family, please submit a feature request with more details.

Further Reading

To learn more about Assignment Maps, check out our other articles: