Profile Mapping

Once the Default Device Profile and User profile are created in the Profile section, it is time to map those profile. The profile must be configured for Shared Device Mode (SDM) to ensure it is applied to the device in both logged-in and logged-out states.

Return to Account Settings > Shared Device Mode > Windows to link your created profiles.

Steps to Configure Profile Mapping

In the Profile Mapping section, configure the Profile for Shared Device Mode which would be applied:

• When Shared Device Mode is enabled
• When the user logs out
• When the user logs in

Profile Mapping Configuration

Profile Mapping dictates which profiles are applied when a device is in a default/logged-out state and which profiles are dynamically applied when a user signs in.

Overview

When a device logged out, SureMDM enforces a baseline SDM Device Profile. Upon user authentication via SureIdP, the system evaluates profile mapping rules sequentially from top to bottom to assign the appropriate SDM User Profile.

1. Default Profile for Shared Device Mode

The Default SDM Profile is mandatory and persists on the device whenever SDM is active, serving as the baseline configuration regardless of user sign-in status.

1. Navigate to the Default Profile for Shared Device Mode section and select Apply Default Profile.
2. In the selection window, pick a profile of type Windows Profile (SDM - Device Profile).
3. Once selected, the profile name displayed as a tag pill.

note

Only one default profile can be assigned to an account. The Apply Default Profile selection button remains inactive until the existing entry is removed.

2. Post-Login Dynamic Profile Mapping Rules

Under Profile Assignment based on Device Properties, define the dynamic assignment rules based on user identity or device criteria.

Step 1: Add Mapping Rule

1. Select + Add to open the Add Profile Mapping window.
2. Provide a unique Mapping Name.
3. Set Mapping Type to Device Properties.

Step 2: Configure Rule Conditions

Configure rule parameters using the supported options below:

Device Properties	Supported Conditions	Value Definition
Device Name	Contains, Does not Contain, Equals, Not Equals to	Enter the Value that would be used for comparison.
Group Path	Contains, Does not Contain, Equals, Not Equals to	Enter group path string(s).
Shared Device User Name	Equals (Strictly enforced)	Select specific SureIdP users via the + Add SureIdP Users directory selection screen.

Step 3: Profile Assignment

• (Optional) Add Mapping Configuration: Add multiple conditions within a single rule entry by clicking Add Mapping Configuration. Use the AND / OR toggle to define how the conditions should be evaluated.
• Select Profile: Select a profile type created as Windows Profile (SDM - User Profile) by clicking on Add Profile option.

Important

Mapping rules are validated for combinations of different property types (e.g., Device Name, Group Path, and Shared Device User Name). Avoid combining multiple conditions of the same property type using the AND operator, as these combinations are not supported or validated.

Top-Down Priority Evaluation Standard

When a user authenticates on an SDM-enabled Windows device:

1. The system evaluates the configured profile mapping rules in the order they appear, from top to bottom.
2. When a matching rule is found based on the user's or device's properties, the corresponding profile is assigned, and the evaluation stops. Any remaining rules are skipped.

Manage Rule Priority

Administrators can change the order of rules at any time using the Move Up and Move Down controls in the console table. Place more specific user or group rules at the top of the list and broader rules further down.

• Click Save to save the configuration.

Profile Mapping Configuration Workflow

The diagram below illustrates the post-login evaluation process and profile assignment logic for Windows Shared Device Mode.

Workflow Breakdown

1. Device Initialization & Baseline State

   • As soon as the device connects online, SureMDM automatically applies the Default SDM Device Profile.
   • This profile enforces baseline security and system settings during logged-out or idle states.

2. User Authentication

   • The user signs in at the device using SureIdP credentials.

3. Top-Down Rule Evaluation

   • The system evaluates configured profile mapping rules sequentially starting from the top entry (Priority 1).

4. Dynamic Profile Application

   • Rule Match: The first rule that matches the logged-in user or device properties triggers deployment of its assigned SDM User Profile (e.g., Profile 1 or Profile 2), and evaluation stops.
   • No Rule Match: If none of the mapping rules match the user's attributes, the device retains the Default SDM Device Profile.

5. Session Reset & Cleanup

   • When the active user signs out, SureMDM removes the mapped user profile and automatically reverts the device back to the Default SDM Device Profile.