Package Configuration and Assignments

Managed Subscription

Packages subscribed as managed come with automatically created and RealmJoin managed user groups. There are different types of groups available that can be chosen based on the specifics of the scenario.

Managed packages are the preferred way to deploy software to your users. You can combine it with automated package updates and lifecycle to ensure your users receive latest features and patches.

Main (Required)

RealmJoin or Intune will automatically install the application. These applications are mandatory and both solutions will continuously attempt to install the application, if not found on the device.

Available

RealmJoin

The application will appear in the RealmJoin Agent tray and will require the user to initiate the download and installation manually.

Intune

Preview

Users and devices in the Preview group will receive the latest version of the package before the other groups. Preview settings are configurable through the Automation tab.

Uninstall

RealmJoin or Intune will uninstall the package from the assigned users and devices. Adding a user or device to the Uninstall group will remove them from all other groups.

Update

Additionally, RealmJoin provides an Update group that is created on demand. The Update group will automatically onboard loose installations of a software title into management.

Click Enable update group and a new Entra ID Group with the suffix "(update)" will be created. Software installations will be also assigned to this group. RealmJoin dynamically discovers installed copies of the software that are unmanaged and adds the devices to the group.

Thus, new versions will also be installed on these devices to assert deployment of security patches across your environment.

Update Group Enabled

Exclude

Needs to be explicitly activated through "More" > "Exclude assignments" (like shown in the picture below). Users in the specified group will be excluded from assignments all over the package and associated managed groups.

This option should only be used in specific cases and is not intended to be used to manage assignment conflicts. You should always manage assignments with clear user to group assignments, without the need of using an exclude mechanic. We strongly advise against multi-layer assignment constructs.

Usage

The Exclude assignment of groups is used to ensure that users in the assigned exclude group are not managed within the package managed groups. It will not remove users from managed groups within the same package. Instead, it makes sure that certain packages are never assigned to the same user simultaneously.

For example, you can use the Exclude function to prevent a user, assigned to a 64-bit Adobe Reader package group, from also receiving the 32-bit version. Simply assign the used 64-bit package group as an exclude to the 32-bit package.

In managed packages, group management is handled by the RealmJoin Portal, which uses the GUID of each group after creation. This enables the portal to identify the provisioning type associated with each group. As a result, it is possible to establish a prioritization mechanism among groups. This ensures deterministic behavior in scenarios where a user is mistakenly assigned to multiple provisioning groups.

The prioritization order is (high to low):

Uninstall - [Exclude] - [Update] - Preview - Available - Required

Enable additional and restore default groups

Via the "More"-Button you can activate the optional update group, manage exclude assignments and also restore the default managed groups in case they were deleted.

Changing Assignments

Users and devices should only be in one RealmJoin managed group at any given time.

Users and devices can easily be moved across groups using the Managed users function.

Selecting Main, Preview, Available and Uninstall will add the user to the chosen group and remove the user from all other groups relevant to the package.

Selecting Assign will add users to the Main group by default.

Basic Subscription

Basic packages do not have any associated Microsoft Entra groups. You will have to manually assign groups, devices or users.

Groups, devices and users that are assigned to a Basic package will be assigned as Available by default and can be changed using the [change settings] button.