FortiClient EMS - Assign deployment to devices when policies are user-based

[droberts83]

Hi,

I'm running FortiClient EMS v7.2.4 and I've deployed FortiClient v7.2.4 to a device, let's call it DeviceA. In EMS I have our Microsoft Entra ID added under Endpoints -> Manage Domains. Within this configuration I am sync'ing in selective groups, for ease, let's call them Device Group and User Group. DeviceA is a member of Device Group and UserA is a member of User Group. I then have various policies (VPN, FW etc) assigned to User Group, with no policies assign to Device Group.

This is working nicely in that UserA is getting the correct policies when logging into DeviceA. Also, in EMS under Endpoints I can see DeviceA in Domains -> Entra ID -> Device Group, which again is to be expected. Now to my issue...

I have created an installer (for v7.0.13 as a test) and a deployment within Deployment & Installers -> Manage Deployment and assigned this to my Device Group. The assignment appears as domain.onmicrosoft.com/Device Group, so it all looks good.

The result: looking at the device within Endpoints it shows no installers assigned, and nothing is deployed as a result. With UserA logged into DeviceA the policy shows correctly as the one assigned to UserA.

Troubleshooting: I added UserA to Device Group, so this group now contains both the device and user.

Result: Still no installer assigned to the device or user and nothing deployed.

Can I please ask for assistance in how to assign a deployment to this device?

Thanks in advance!

[Jean-Philippe_P]

Hello droberts83, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[droberts83 · Accepted solution]

Thanks for the reply Jean-Philippe.

I have managed to resolve this...it turns out the device was in more than one Entra sync'd group. Removing the device from one of these groups and then assigning the deployment to the other group resolved the situation.

[skanda2]

The device was within two Entra sync'd groups. Removing the device from one of these groups and ensuring the deployment was assigned to the remaining group was the resolution.