Product documentation
Citrix DaaS™
View PDF

Manage policy assignment exceptions

June 1, 2026
Contributed by: 
C

When you assign policies to groups of users, user devices, or machines using filters, some members of the group might need different settings. You can handle these cases without creating entirely separate policies for each individual.

You can make exceptions for certain users or machines within a group by:

  • Creating a separate policy only for those group members and giving it higher priority
  • Using the Deny mode for an assignment added to the policy

Use Deny mode for exceptions

An assignment with the mode set to Deny means that the policy applies to connections that don’t match the assignment criteria. For example, a policy includes the following assignments:

  • Assignment A: Client IP address assignment range 208.77.88.*, mode = Allow.
  • Assignment B: Specific user account, mode = Deny.

This policy applies to users connecting from the specified IP range, except the user defined in Assignment B.

Note:

In the Assign Policy step, if you clear the Enable checkbox, the assignment is disabled. If a policy has no enabled assignments, it applies to all objects in the site.

Related content

Manage policy assignment exceptions
June 1, 2026
Contributed by: 
C
June 1, 2026
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.