Introduction
The tag removed trigger fires when one of the tags you select is removed from a device. Use it to automatically reverse or clean up whatever the tag applied trigger started — uninstalling software, unenrolling from a monitoring tier, or running any offboarding sequence when a device loses a tag.
Common examples:
Remove an OFFICE tag → automation uninstalls Microsoft Office
Remove an AV or HUNTRESS tag → automation removes the security agent
Remove a MANAGED tag → automation runs your full offboarding sequence
Remove a LOST tag → automation confirms wipe or sends a status notification
ℹ️ NOTE: Adding non-manual triggers requires either admin status or a role with the Manage automations permission. If you can see the automation but can't add triggers, check your role's permissions with your admin. See Workspace → Permissions for details.
Tag Removed Trigger
Step Configuration
Select the tags this trigger watches. It fires when any of the selected tags is removed from a device.
Check the tags you want to watch in the tag picker.
Use the search field to find specific tags quickly.
You can also create a new tag directly from this picker using the + Create new tag button.
Condition
You must select a condition to save the trigger. Choose All devices to fire for any device that loses the tag, or narrow the scope with a Group or Platform condition.
For the full condition reference, see Trigger Conditions.
ℹ️ NOTE: The tag picker defines which tag events the trigger watches. The Condition field is an additional filter on the device — both must be satisfied for the trigger to fire.
Additional Options
Expand Additional options to set an optional Trigger name and toggle the trigger on or off with the Enabled switch.
Trigger name — Replaces the default label on the pipeline trigger card.
Enabled — When off, the trigger won't fire. In-progress runs are unaffected.
The Tag-Automation Loop
This trigger is designed to be paired with the tag applied trigger. One automation handles the forward action; this one handles the reversal. Together, the tag becomes a toggle — applying it starts a workflow, removing it unwinds it.
⚠️ WARNING: If you remove a tag that's targeted by a monitor policy, that policy stops applying to the device immediately. Make sure tag removal is intentional when monitors are in play.
For more on the tag-automation pattern, including dynamic tagging and real-world examples, see Tags.
FAQ
Does this trigger fire if an automation removes the tag, or only if a technician does it manually? Both. The trigger fires whenever the tag is removed from a device, regardless of what caused it — a manual removal, a bulk action, or another automation removing the tag as an action.
Does this trigger fire if the tag itself is deleted from Level? No. Deleting a tag entirely is not the same as removing it from a device. This trigger only fires when a tag is explicitly removed from a device.
Can I watch multiple tags with a single trigger? Yes. Select as many tags as needed. The trigger fires when any one of them is removed.
Who can add or edit triggers on an automation? Admin users can always add triggers. Non-admin users need the Manage automations permission on their role, plus access to the automation's group. If an automation has no triggers yet, any user with group access can add the first one.