Best practices for deciding between device filters or groups
Opting for either device filters or groups essentially produces the same result: a number of devices grouped together that can be targeted by a policy or a job. However, these options have different use cases. A filter could be compared to a dynamic group.
Device filters
Filters are used to group devices together based on common attributes either from the device audit information or from data stored in a user-defined field. Filters are dynamic, as the devices they include must match certain criteria and are removed if they cease to match that criteria.
EXAMPLE A filter may be required for a custom Monitoring policy, for example. In the event you need to apply special monitoring to all the Microsoft SQL Servers in the platform, you would create a filter to find and group all the devices that have SQL installed. The filter could then be used as a target for your new custom Monitoring policy. As filters are dynamic, any new devices added to the platform that match the criteria will be automatically included in the filter results. Therefore, the custom Monitoring policy would be automatically applied to those devices.
For more information about device filters, refer to Device filters.
Groups
Groups are used for any combination of devices, either from a single site or across multiple sites, that you wish to bring together for any reason. Unlike filters, you need to manually add or remove devices to or from groups.
EXAMPLE A group may be useful for a pilot patch group, for example. In the event you need to install the latest Microsoft patches on a test group of devices before they are installed into the production environment, you may wish to select one device from each department or customer to act as the pilot machine. In this scenario, the devices don't have to share any criteria (other than you wanting them to be part of your pilot patch group).
For more information about groups, refer to Groups.