Introduction

Custom fields let you attach structured data to every device in your organization — things like client credentials, deployment tokens, admin passwords, or any value your automations and scripts need to reference. Fields are defined here at the workspace level and cascade down to device groups and individual devices, which can inherit the global default or set their own override.

This is where you create, edit, and delete custom fields. For setting group-level defaults, see Group Settings → Custom Fields. For overriding values on a specific device, see Device Details → Custom Fields.

The Custom Fields Listing

Navigate to Workspace → Custom Fields to see every field defined for your organization.

Field name — the name of the field, sortable alphabetically. Click the column header to toggle sort order.
Description — an optional description explaining how the field is used or what values are expected.
Field value — the global default value for this field. Groups and devices can override this, but any scope without its own value inherits from here.

Fields with no global default show -- in the Field value column. That's expected — some fields are intentionally left blank at the global level and set individually per group or device.

How Values Cascade

Custom fields work on a three-level cascade: organization, group, device. Level always resolves to the most specific value available.

Organization — the global default, set here in Workspace → Custom Fields
Group — an override for all devices in a device group, set in Group Settings → Custom Fields
Device — an override for one specific device, set in Device Details → Custom Fields

If a group has no override set, it inherits from the organization. If a device has no override set, it inherits from its group (or the organization if the group also has no value).

💡 TIP: Set organization-level values for fields that apply across all or most clients, and use group-level overrides for per-client variation. Device-level overrides are best reserved for exceptions — a single device that needs a different credential, token, or setting from the rest of its group.

Creating a Custom Field

Click + Add custom field in the top right.
In the Add custom field panel, enter a Field name. Required. This is how the field will be referenced in automations and scripts, so use a consistent naming convention.
Optionally, add a Description explaining how the value is used or any compliance implications.
Optionally, enter a Field value to set a global default. You can leave this blank and set values at the group or device level instead.
If the field will contain sensitive data (passwords, tokens, recovery keys), enable the Admin only toggle.
Click Add custom field.

The new field appears in the listing immediately, sorted alphabetically. The value you entered during creation becomes the global default and cascades down to all groups and devices that don't have their own override set.

Copying a Field Value

Each row has a copy icon on the right. Click it to copy the global default value to your clipboard.

Editing a Field

To change a field's name, description, global value, or Admin only setting:

Click the ⋮ menu on the row.
Click Edit.
Update any fields in the Edit custom field panel.
Click Update custom field.

Renaming a field updates every reference to it automatically — automations, scripts, and any other place the field is used will reflect the new name.

Forcing a Value to All Descendants

When editing an existing field, a Force field value to all descendants checkbox appears in the panel. When checked, saving will push this global value down to all device groups and devices, removing any overrides they've set.

⚠️ WARNING: Force field value to all descendants is irreversible. It removes all group and device overrides for this field across your entire organization. Every device will revert to this global value. Use this only when you intentionally want to standardize a value everywhere.

Admin Only Fields

When Admin only is enabled, the field value is masked everywhere in the web interface — shown as dots with an eye icon to reveal it. Only account administrators can view or edit the value. Other technicians can see the field exists, but not its contents.

Non-admin technicians can still reference Admin only fields in automations and scripts. The field resolves normally at execution time — the restriction is on visibility in the UI, not on use.

Admin only is appropriate for:

Local admin passwords
Client deployment tokens
Recovery keys
Wi-Fi credentials
Any value that shouldn't be visible to all technicians

Clearing a Global Value

To remove the global default value from a field without deleting the field:

Click the ⋮ menu on the row.
Click Clear value.

The field value returns to --. Groups or devices that had no override will now also show -- until a value is set at their scope.

ℹ️ NOTE: Clearing the global value doesn't affect group or device overrides. Groups and devices that already had their own value set keep it.

Deleting a Custom Field

Custom fields can only be deleted from Workspace → Custom Fields. To remove a field entirely:

Click the ⋮ menu on the row.
Click Delete.
Confirm the deletion.

⚠️ WARNING: Deleting a field removes it from every device and group in your organization and can't be undone. Any automations or scripts that reference this field will stop receiving a value — verify nothing in active use depends on the field before deleting.

Using Custom Fields in Automations and Scripts

Custom fields become genuinely useful when automations and scripts read them at runtime. Level resolves the value using the cascade — device first, then group, then organization — and passes whichever is most specific to the running automation or script.

Referencing a Custom Field in a Script

In the script editor, click the Variable button and select the custom field you want to reference. Level inserts a variable placeholder using the field name:

{{cf_field_name}}

Level resolves the variable at execution time — substituting in the value from whichever scope is most specific for the device the script is running on.

For example, a script that reads an "Asset Tag" field:

#!/bin/bash ASSET_TAG={{cf_asset_tag}} echo "Asset Tag for this device is: $ASSET_TAG"

💡 TIP: Use the Variable button rather than typing the syntax manually. It ensures the field name matches exactly and shows only the custom fields defined in your organization.

Common Patterns

Per-client tokens: Set a deployment token (SentinelOne, third-party AV, etc.) at the group level for each client. An automation that references the field picks up the right token for whichever device it runs on, with no hardcoded values.
Admin passwords: Store each device's local admin password at the device level, marked Admin only. Scripts can retrieve and use it without exposing it to non-admin technicians.
BitLocker recovery keys: Use a scheduled automation to run a PowerShell script that retrieves the recovery key and writes it back to an Admin only custom field via the Set Custom Field action — so the key stays current automatically.
Authorized admin lists: Define a global list in an "Authorized Admins" field. Override it for groups or devices that need a different set.
Environment flags: Use a field like "Managed" or "Standards Bypass" as a flag that scripts check before applying configurations.

For details on the Set Custom Field action, see Automations → Actions → Set Custom Field. For trigger-based workflows that fire when a field changes, see Automations → Triggers → Custom Fields Changed.

FAQ

How do I reference a custom field in a script or automation? In the script editor, use the Variable button to insert a field reference. Level uses the syntax {{cf_field_name}} and resolves the value at execution time — the script receives whatever value is active for the device it's running on.
If I rename a field, do my existing automations and scripts break? No. Level updates all references automatically when you rename a field. Anything already using that field will continue to work with the new name.
Who can see Admin only fields? Only account administrators can view or edit the value. Other technicians can see that the field exists and can reference it in automations and scripts, but the value is hidden from them in the web interface.
I deleted a field by mistake. Can I recover it? No. Deletion is permanent. Recreate the field and re-enter any values that were set at the organization, group, and device levels.
I forced the global value to all descendants, but one device still shows a different value. Why? Forcing a value removes overrides at the time you save. If a device-level override was set after that point, it would take precedence again. Check the device's Custom Fields tab to see whether a new override has been set.
Can technicians without admin access create or delete custom fields? No. Creating, editing, and deleting custom fields requires administrator access. Non-admin technicians may be able to set device-level overrides depending on their group permissions, but they can't modify the field definitions here.