---
title: "Organize endpoints with sites, device groups, and tags"
description: "Create sites and device groups, assign endpoints to them, and define tags that Outpost applies from what runs on each endpoint."
url: "https://support.outpostplatform.com/endpoints/organize-endpoints/"
product: "depot"
type: "how-to"
status: "draft"
ai_summary: "How to organize endpoints. Sites are buildings or departments with a parent, code, and time zone; a site's Overview tab shows that site's own dashboard, not its child sites. Device groups are named sets of endpoints a profile targets. Tags are glob rules over service, software, or process names that Outpost applies automatically. Permissions identity:manage, endpoint:write, and tag:manage."
availability:
  plans: ["home-lab", "essentials", "enterprise", "msp"]
  permission: "identity:manage"
  preview: false
source: "https://gitlab.com/outpostplatform/docs/-/edit/main/src/content/docs/endpoints/organize-endpoints.md"
license: "CC BY 4.0"
---

# Organize endpoints with sites, device groups, and tags

Sites, device groups, and tags are three ways to sort your endpoints, so a
profile, a filter, a report, or a bulk action can aim at a set of endpoints
instead of a list of names. This page shows how to create each one and put
endpoints in it.

| Use | When you are sorting by | Example |
| --- | --- | --- |
| A site | Where the computer is | Head office, Warehouse |
| A device group | What the computer is for, chosen by you | Nurse stations, Build servers |
| A tag | What runs on the computer, detected by Outpost | Dentrix server |

Profiles can be assigned to a site or a device group. See
[Profiles](/automation/profiles/).

## Before you begin

- Creating and changing sites and device groups needs `identity:manage`.
  Reading them needs `identity:read`.
- Changing an endpoint's site needs `endpoint:write`.
- Creating and changing tags needs `tag:manage`. Anyone with `endpoint:read`
  can see them.

## Create a site

1. Go to **Endpoints** > **Sites**, and select **New site**.
2. In **Name**, enter the site's name.
3. Optional: in **Code**, enter a short label for reports, such as `HQ`.
4. Optional: in **Parent site**, choose the site this one sits under. A site
   cannot sit under itself or under one of its own sites.
5. Optional: in **Time zone**, choose the site's time zone. Maintenance
   windows for the site are read in this time zone. A site with no time zone
   chosen uses UTC.
6. Select **Create site**.

A site can also hold a postal address and a phone number, under **Address
and phone** in **New site**, or later with **Edit** in the site's row. All of
them are optional. The site's **Overview** tab shows them under **Details**.

The sites list shows an **Endpoints** count for each site.
Each site has a detail page with **Overview** and **Documentation** tabs. Select
a site's name to open it.

### Read a site's overview

The site's **Overview** tab opens with **At this site**, a dashboard for the
site, followed by the site's **Details**. The figures cover this site only,
not the sites under it.

| Block | What it shows |
| --- | --- |
| Tiles | **endpoints online**, **open alerts**, **patch compliant endpoints**, and, on plans with the service desk, **open tickets**. Selecting **endpoints online** opens the site's endpoints. |
| **Fleet status** | A chart of the site's endpoints by online, offline, and stale. Shown when the site has endpoints. |
| **Open alerts by severity** | A chart of open alerts by critical, warning, and info. Shown when the site has open alerts. |
| **Least healthy endpoints** | The 5 endpoints at the site with the lowest health score. Select one to open it. |

**View this site's endpoints** opens **Endpoints** > **All endpoints**
filtered to the site. The filter applies to that visit only and does not
replace the filters the list remembers for you.

Each block needs the permission to read what it counts. A block your role
cannot read shows **Not shown.** and the reason, such as **Your role does not
include alert access.**, never a zero.

### Assign an endpoint to a site

New endpoints join the site chosen when their installer was downloaded. To
change an endpoint's site:

1. Open the endpoint.
2. On the **Overview** tab, in the **Site** row, choose a site, or **No site**.

The change saves when you choose. To move an endpoint to a site in
another client, see
[Transfer an endpoint](/endpoints/endpoint-actions/#transfer-an-endpoint-to-another-client).
To see every endpoint at a site, select **View this site's endpoints** on the
site's **Overview** tab.

### Move several endpoints to a site

1. In **Endpoints** > **All endpoints**, select the endpoints to move.
2. Select **Move to site**.
3. Choose a **Site**, or **No site** to clear the assignment.
4. Select **Apply** and check the result for any endpoints that could not be moved.

This changes the site within the same client. To move several endpoints to
another client, see
[Transfer several endpoints at once](/endpoints/endpoint-actions/#transfer-several-endpoints-at-once).

### Delete a site

Select **Delete** in the site's row, then **Yes, delete it**. Outpost refuses
while child sites or endpoints still belong to the site, and names them. Move
them elsewhere first.

## Create a device group

1. Go to **Endpoints** > **Device groups**, and select **New group**.
2. In **Name**, enter the group's name. Optional: add a **Description**.
3. Select **Create group**.

### Add endpoints to a device group

1. Open the group, and in **Members**, select **Add a member**.
2. In **Find an endpoint**, enter a hostname, serial number, model, or user,
   and press <kbd>Enter</kbd>.
3. Select **Add** beside each endpoint you want.

Select **Remove** in a member's row to take it out of the group.

For several endpoints, select their rows in **Endpoints** > **All endpoints**,
then select **Add to group** or **Remove from group**. Choose a **Static group**,
select **Apply**, and check the result for any endpoints that could not be updated.

For one endpoint, open its **Overview** tab. In **Groups**, choose a group
and select **Add**, or select **Remove** beside a membership. These actions
need `identity:manage` and apply only to static groups. Groups marked
**Dynamic** get their membership from rules.

Deleting a group stops every profile assigned to it from applying.

## Define a tag

A tag is a label Outpost applies automatically to every endpoint that matches
its rules. It shows beside the detected [server roles](/endpoints/server-roles/)
in the **Roles & tags** column, and you can filter the endpoint list by it.

1. Go to **Endpoints** > **Tags**, and select **New tag**.
2. In **Key**, enter the identifier filters and device groups use. It is
   lowercase letters, numbers, hyphens, and underscores, up to 40 characters,
   and it cannot be changed later.
3. In **Label**, enter what the chip on the endpoint reads, such as
   `Dentrix server`.
4. Optional: add a **Description**.
5. Under **Rules**, choose what each rule looks at and enter a pattern:

   | Rule | Matches |
   | --- | --- |
   | **Service name** | An installed service that is not disabled |
   | **Installed software** | An installed application |
   | **Running process** | A process running at the last inventory |

   A pattern is a wildcard match that ignores case, such as `Dentrix*`. An
   endpoint gets the tag when any rule matches. Select **Add rule** for more,
   up to 20 rules of up to 200 characters each.

6. Select **Preview matches** to see how many endpoints match.
7. Select **Create tag**.

Prefer a service or software rule when one exists. A process rule matches only
what was running at the last inventory, so an application that runs some of
the time can gain and lose the tag.

When you create or change a tag, Outpost checks every endpoint against the tag again. A tag with
a process rule also asks each endpoint for a fresh inventory. After that, tags
are rechecked at each inventory.

On the MSP plan, a tag created from the MSP console applies to **Every
client**. A tag created inside a client applies to **This client only**.

Deleting a tag removes it from every endpoint it is on.

## Verify

On **Endpoints** > **All endpoints**, select **Filters**, add **Roles & tags**
**is** your new tag, and apply. The list shows the endpoints the tag matched,
and the **Roles & tags** column shows the tag's label on each.

## If something goes wrong

| Symptom | Cause | Fix |
| --- | --- | --- |
| A site cannot be deleted | Child sites or endpoints still belong to it. | Move them, then delete the site. |
| A tag matches no endpoints | The pattern does not match the exact name the endpoint reports. | Check the name on the endpoint's **Software** tab, and use `*` for the parts that vary. |
| An endpoint drops a process tag | The process was not running at the last inventory. | Use a service or software rule instead. |

## Next steps

- [Profiles](/automation/profiles/)
- [Server roles](/endpoints/server-roles/)
- [Wake-on-LAN](/endpoints/wake-on-lan/), to wake every offline endpoint in a site or a group