Introduction
The tag applied trigger fires when one of the tags you select is applied to a device. Applying a tag becomes the signal to act — install software, push configuration, enroll a device into a monitoring tier, or kick off any other workflow automatically.
This is the core pattern for tag-driven automation in Level: a tag represents a desired state, and the automation makes it real.
Common examples:
Apply an OFFICE tag → automation installs Microsoft Office
Apply an AV or HUNTRESS tag → automation installs the security agent and pulls in the monitoring policy
Apply a MANAGED tag → automation runs your full onboarding sequence
Apply a LOST tag → automation locks the device or initiates a remote wipe
ℹ️ NOTE: Adding non-manual triggers requires either admin status or a role with the Manage automations permission. If you can see the automation but can't add triggers, check your role's permissions with your admin. See Workspace → Permissions for details.
Tag Applied Trigger
Step Configuration
Select the tags this trigger watches. It fires when any of the selected tags is applied to a device.
Check the tags you want to watch in the tag picker.
Use the search field to find specific tags quickly.
You can also create a new tag directly from this picker using the + Create new tag button — useful when you're building the automation and the tag doesn't exist yet.
Condition
You must select a condition to save the trigger. Choose All devices to fire for any device that receives the tag, or narrow the scope — for example, a Group condition to limit firing to devices in specific groups.
For the full condition reference, see Trigger Conditions.
ℹ️ NOTE: The tag picker defines which tag events the trigger watches. The Condition field is an additional filter on the device — both must be satisfied for the trigger to fire.
Additional Options
Expand Additional options to set an optional Trigger name and toggle the trigger on or off with the Enabled switch.
Trigger name — Replaces the default label on the pipeline trigger card.
Enabled — When off, the trigger won't fire. In-progress runs are unaffected.
The Tag-Automation Loop
Tag applied and tag removed triggers are most useful as a pair. The tag applied trigger runs the forward action (install, enroll, configure); a separate automation with the tag removed trigger runs the reverse (uninstall, unenroll, clean up).
This makes tags act as toggles. Applying a tag starts a workflow; removing it unwinds it. You don't touch individual devices — the tag drives the state.
💡 TIP: Pair this trigger with the Tag Removed Trigger on a second automation to create a full install/uninstall lifecycle. Apply OFFICE installs it; remove OFFICE uninstalls it. Both automations run automatically, no manual steps needed.
For more on the tag-automation pattern, see Tags.
FAQ
Does this trigger fire if an automation applies the tag, or only if a technician does it manually? Both. The trigger fires whenever the tag is applied to a device, regardless of what caused it — a technician tagging manually, a bulk action from the device listing, or another automation applying the tag as an action.
Does this trigger fire for devices that already have the tag when I enable it? No. It only fires on the event — when the tag is applied. Devices already carrying the tag are not pulled in retroactively.
Can I watch multiple tags with a single trigger? Yes. Select as many tags as needed in the tag picker. The trigger fires when any one of them is applied.
Who can add or edit triggers on an automation? Admin users can always add triggers. Non-admin users need the Manage automations permission on their role, plus access to the automation's group. If an automation has no triggers yet, any user with group access can add the first one.