Skip to main content
Cisco Meraki

Types of Tags in Systems Manager

Before creating and applying tags, it's important to understand the different types of tags available.

Note: For information on using and configuring tags in Systems Manager, refer to this article.

Device Tags 

2017-07-21 15_38_38-Apps - Meraki Dashboard.png2017-07-21 15_39_07-Apps - Meraki Dashboard.png

Manual - Simple admin generated tags that are applied statically to devices. These are labeled when scoping simply as "Tags". Must be manually added/removed, and are always active.

Device type - These are automatically generated and assigned to devices by Dashboard based on operating system. Listed under "Auto tags" on client pages.

Policy Tags 

Most tags are considered static, meaning the tag remains unchanged unless it is modified or removed by a Dashboard Admin. Policy tags are considered dynamic, as they can automatically change themselves into one of two binary states (i.e. compliant or violating, within hours or after hours). This allows you to gate settings or applications on devices meeting certain criteria, for example pushing work materials only during work hours, or only to devices that are within school location bounds. Continue reading below, or check the profile example.

Screen Shot 2017-06-01 at 4.45.33 PM.png2017-07-21 15_40_11-Apps - Meraki Dashboard.png2017-07-21 15_40_39-Apps - Meraki Dashboard.png

Security policy - For each policy configured in Dashboard, devices are either compliant or violating, and will automatically be labeled with the corresponding tag. These are set under Configure > Policies. For more information, refer to the article on security policies.


Geofencing - These dynamic tags are automatically assigned to devices depending if they are within a designated physical boundary, such as a campus or office location. These are set under Configure > Geofencing. For more information, refer to the article on Geofencing.


Schedule - Only active during scheduled periods. Also known as time-based tags. Configured under Configure > General.

User Tags 

Screen Shot 2017-06-01 at 3.36.36 PM.pngScreen Shot 2017-06-01 at 3.43.56 PM.png

Active Directory - Another example of dynamic tags. If you configure enrollment authentication with AD or Meraki-hosted accounts, Systems Manager can use your existing AD organization units as tags. During enrollment, users will authenticate their device and automatically have owner or AD groups applied as tags to that device. This allows you to scope by user role, like 'Administrators', instead of manually marking each device or owner as an administrator.

Owner Tags - Similar to manual device tags, except these are applied directly to owners under Configure > Owners. These can be used to scope by individual, or by role. For example, if 'Patrick' owns multiple devices, or multiple devices belonging to people labeled 'sales', it may be easier to scope by owner tag instead of device tag.

Time-based tags can be used with Systems Manager (MDM) to dynamically add and remove profiles from devices based on defined time periods. This can be very useful if profiles should only be present on devices during particular times, such as during business hours. This article will discuss how to create time-based tags and how they operate. For information on applying tags, such as time-based ones, to profiles, please reference the article on Using and Applying Tags in Systems Manager.


Note: Time-based tags are only available for Systems Manager Enterprise customers.

Time-Based Tags

Time-based tags apply to all client devices in the network they are configured for. When within the time bounds defined for the tag, it will be active as an Auto tag for any clients. This can then be used in conjunction with profiles.

2017-07-21 16_13_06-Clients - Meraki Dashboard.png


As with any other changes to profiles and clients, for the change to go into effect, the client must be reachable to Systems Manager. Thus a profile dependent on a time-based tag that goes inactive at 15:00 may not actually be removed until some time later when the client is reachable. Likewise, a profile dependent on a tag going active at 08:00 may not be applied until 10:00 if that is the first time the client is reachable after 08:00.


In the example configuration below, two tags are configured:

business_hours - Active on Mon-Fri, from 8am-5pm each day.

weekend_shift - Active Sat and Sun, from 7am-7am each day.

2017-07-21 16_14_15-General - Meraki Dashboard.png

Creating Time-Based Tags

  1. Navigate to Configure > General.

    2017-07-21 16_14_57-General - Meraki Dashboard.png
  2. Under the Time based tags section, click Add a new tag. If any tags already exist, this link will be at the bottom of the list.

    2017-07-21 16_15_42-General - Meraki Dashboard.png
  3. Enter a Tag name that describes the time period and will be displayed on relevant profiles and devices.
  4. Select a Start time that indicates when a tag should be active on each selected day.
  5. Select an End time that indicates when a tag should go inactive on each selected day.
    Note: This must be greater than the Start time.
  6. Check the box next to any Days of the week that the tag should be active, within the bounds of the Start and End times.

    2017-07-21 16_16_38-General - Meraki Dashboard.png
  7. Click Save Changes.

When this tag is active, it will be listed under Auto tags for clients in the network.

Removing Time-Based Tags

  1. Navigate to Configure > General.
  2. Under the Time based tags section, find the tag that should be removed.
  3. Click the X on the far right of the tag configuration, under the Remove column.

    2017-07-21 16_17_11-General - Meraki Dashboard.png
  4. Click Save Changes.