How IT teams set up role-based software installation with Rippling IT

What you'll learn

• How to automate software deployment based on role, department, or device attributes

• How Rippling uses Supergroups to determine who receives each application

• How to keep software standardized and compliant across your device fleet

What you'll need

• Rippling IT with Device Management

• Devices enrolled in Rippling Device Management

• Defined employee attributes such as department, role, and location

The problem

Most IT teams spend significant time installing and maintaining software manually. New hires often receive applications days after they start. As employees switch teams or roles, their software stack can drift from what is required, leading to outdated tools, licensing waste, and inconsistent security posture across devices.

Legacy device management tools can push software, but they do not connect those deployments to real-time employee data or device state. Without automation tied to job and device attributes, IT relies on spreadsheets to track who should receive what. This slows down onboarding, complicates audits, and increases the risk of unapproved or missing applications across the fleet.

The hypothesis

If software installation is tied directly to the real-time employee and device data inside Rippling, IT teams can automate the full lifecycle of software deployment. When someone joins, their assigned device receives the exact applications required for their role. When they change departments, the software updates automatically. If they leave, assigned apps are removed.

By using Supergroups and device attributes, Rippling can install and remove applications in a way that stays aligned with both job requirements and device capabilities, without relying on custom scripts, manual installs, or one-off processes.

The solution

1. Use Rippling as the source of truth for employee and device data

Role-based software installation starts with accurate data from Rippling’s HRIS or a connected HR system or directory, combined with device details collected by Rippling Device Management. This includes:

• Department, role, and location

• Employment type

• Device OS, hardware type, or processor

• Device assignment status and security posture

When devices are enrolled using zero-touch deployment or self-enrollment, the Rippling Device Management works to provide continuous, real-time device data. This gives you a single dataset to power dynamic installation rules.

2. Create Supergroups that define who should receive each application

Supergroups let you define dynamic groups based on employee or device attributes. When those attributes change, group membership updates automatically. This makes it possible to deploy software based on criteria like:

• All engineers

• All customer support employees

• All employees in specific locations

• All users in regulated departments who require security tools

You can use any combination of attributes supported in Rippling, and Supergroups update immediately as data changes. When someone joins, moves teams, or changes devices, Rippling updates their group membership and software deployment rules without manual intervention.

3. Deploy software from Rippling’s catalog or upload your own packages

From the Devices app, IT can deploy software to managed macOS and Windows devices using Rippling’s built-in software catalog or by uploading custom installers. Once software is assigned to a Supergroup:

• Rippling installs the application the next time the device connects

• System-level applications become available to all users

• User-level applications install per logged-in account

• Removal happens automatically when someone leaves the group

• If the user uninstalls the app manually, Rippling reinstalls it within the next hour

Devices must be enrolled with Rippling Device Management for installation to work. If a device is unassigned, Rippling will wait to install software until it is assigned to a user who meets the deployment rules.

4. Manage exceptions and advanced requirements

Different teams may require more granular targeting. Rippling supports deployment logic based on:

• Device OS or processor type

• Custom attributes

• Department- or location-specific rules

• Any combination of employee or device data

Because Supergroups are attribute-based, IT can easily deploy software only to devices that support it or only after a training or policy requirement is met.

5. Automatically maintain and audit your software footprint

Because Rippling Device Management monitors device state continuously, Rippling provides real-time visibility into software deployment. This allows your IT team to:

• Review which devices have successfully installed required applications

• Identify uninstalled, outdated, or missing software

• Remove or redeploy software when Supergroup membership changes

• Confirm which employees and devices should have access

When preparing for an audit or security review, IT can rely on Rippling as the single place that shows which users and devices have each application and why.

The impact

✓ New hires and employees who change roles receive the applications they need automatically

✓ IT eliminates manual installs and one-off troubleshooting

✓ IT gets real-time visibility into software deployment across the entire fleet

By tying software deployment to employee and device data through Supergroups, Rippling IT transforms application installation from a manual, repetitive task into a fully automated workflow that scales with your organization.

FAQs