Configure Project Policies

Project policies define the configuration that Edge Infrastructure Services automatically pushes to nodes when they join a project. You configure policies during project creation in the Policies step of the creation wizard. Where you update a policy afterward depends on the project type:

On a Standard or Azure IoT project, the policies belong to the project. Update them from the Policies section of the project’s Configure modal.
On a Deployment project, the policies belong to individual deployment records. Update them by adding a deployment record from Configure > Deployment Profile > Deployments. The project has no Policies section.

The policy types available also depend on the project type. Volume Instance Policy is available on Deployment projects only, and Edge Sync Policy is available on Standard and Azure IoT projects only. For a comparison, see Projects Overview.

Node Policy

Defines attestation and configuration lock behavior for nodes in the project.

Field	Description
Name	Unique policy name within the enterprise. Cannot be changed after creation.
Title	Display label. Can be changed after creation.
Tags	Key-value pairs that determine which nodes this policy applies to.
Enforce Attestation	Enables TPM-based (Trusted Platform Module) remote attestation for all nodes in the project. Verifies that node hardware and software have not been tampered with. Recommended for deployments with strict compliance or security requirements.
Configuration Lock	Prevents Edge Infrastructure Services from pushing automated configuration updates to nodes in the project. Useful when you need precise control over when configuration changes reach a set of nodes. Available on Standard projects only.
802.1X Port-Based Network Access Control	Enables 802.1X authentication on node network ports, requiring connected devices to authenticate before they can access the network.

For background on remote attestation, see Trusted Platform Module-Based Remote Attestation.

Virtual Networks Policy

Defines the virtual network that Edge Infrastructure Services automatically creates on nodes when they join the project. For full details on network fields, see Networks.

Field	Description
Virtual Network Name Prefix	Prefix applied to the name of virtual networks created by this policy. Unique across the enterprise. Cannot be changed after creation.
Virtual Network Title Prefix	Prefix applied to the display title of virtual networks created by this policy. Can be changed after creation.
Target Tags	Determines which nodes receive this network configuration.
Policy Configuration Tags	Key-value pairs used to selectively apply this network configuration to edge apps or nodes with matching tags.
Connection Type	Select Switch for a bridged network or Local for a routed network.
Port	The network port or adapter label the network should use. Predefined labels include None (air-gapped), Uplink (all management ports), Freeuplink (zero-cost management ports), and All (every port).
Addressing	Specifies the IP addressing mode for the virtual network.
Default Virtual Network	When enabled, automatically assigns this virtual network to any new edge app created on target nodes.
IP Configuration Mode (Local connection type only)	Select Auto to use DHCP for dynamic IP assignment, or Manual to specify a static subnet and gateway.
Hostnames	Optional hostname entries to associate with this virtual network.

Volume Instance Policy

Available on Deployment projects only. Defines persistent storage volumes that Edge Infrastructure Services automatically creates on nodes carrying the deployment’s tag. For full details on volume instance fields, see Applications.

Field	Description
Name	Unique policy name within the enterprise. Cannot be changed after creation.
Title	Display label. Can be changed after creation.
Target Tags	Determines which nodes this volume configuration applies to. Required.
Type	Select Content Tree for an immutable image-backed volume, or Block Storage for a read/write block device.
Access Mode	Select Read/Write (any app can read and write), Read Only, or Multi-Read Single-Write.
Image	The app image to use as the volume source. Available for Content Tree volumes only.
Policy Configuration Tags	Key-value pairs used to configure this policy.
Label	An optional identifier used to select preferred volume instances for deployments. Can contain letters, numbers, and special characters.
Encrypted	When enabled, the volume is encrypted at rest. Available for Block Storage volumes only.
Max Storage Size	The maximum size for the volume. Enter a number and select a unit (B, KB, MB, GB, or TB). Available for Block Storage volumes only.

Select Add Volume Instance Policy to add additional volume instance policies to the deployment.

Edge Apps Policy

Defines the edge application automatically deployed to nodes matching the policy tags. For full details on edge application fields, see Applications.

Field	Description
Name Prefix	Prefix used for the internal names of edge app instances created by this policy. Unique across the enterprise. Cannot be changed after creation.
Title Prefix	Prefix used for the display titles of edge app instances created by this policy. Can be changed after creation.
Target Tags	Determines which nodes receive this app deployment. The policy deploys the edge app to all nodes whose tags match the tags specified here.
Edge App	The specific edge application this policy deploys.
Naming Scheme	Defines how individual instances of the app are named when deployed to target nodes. Options include combinations of project identifier, app identifier, and instance name.
Project Identifier	The project-level identifier used as part of the instance naming scheme.
App Identifier	The app-level identifier used as part of the instance naming scheme.
Staggered Start Delay	The delay applied between starting successive instances of this edge app on different nodes. Useful for avoiding simultaneous resource contention across a large fleet.
Policy Configuration Tags	Key-value pairs used to further categorize and manage this policy.

Edge View Policy

Defines how and under what conditions users can access nodes through an Edge View remote access session. For full details on Edge View, see Edge View and Remote Access.

The Edge View policy requires the Edge View Session entitlement. Without it, the policy is not offered in the project creation wizard or the Add Deployment dialog, and it does not appear in the review summary. A project that already has an Edge View policy keeps showing it on the project detail page and in the project Configure tab, so removing the entitlement never hides configuration that already exists. The project’s Edge View policy, rather than this entitlement, governs node-level remote access such as the remote console, Collect Info, and the node Edge View panel. Entitlements are set per enterprise and must also be enabled at the root enterprise. See Admin Dashboard.

Access details

Field	Description
Name	Unique policy name within the enterprise. Cannot be changed after creation.
Title	Display label. Can be changed after creation.
Access EVE-OS	Allows Edge View session users to access EVE-OS (Edge Virtualization Engine) on the node.
Allow ZEDEDA Cloud Session only	Disables Edge View Docker client sessions, restricting access to cloud-initiated sessions only.
Override access policies	Allows the local administrator to override Edge View settings at the individual node level.
Access Edge Applications	Allows users with an active session to interact with edge applications running on the node.

Session details

Field	Description
Maximum time allowed for session	The absolute maximum duration an individual Edge View session can last.
Maximum connections allowed	The maximum number of simultaneous connections permitted within a single session.
Default time allowed for session	The pre-set duration applied when a new Edge View session starts.
Default connections allowed	The number of simultaneous connections allowed when a new session starts.
Dispatcher URL	The network address of the ZEDEDA service component that manages Edge View connections.

Edge Sync Policy

Available on Standard and Azure IoT projects only. Defines the synchronization source and data store for nodes in the project. Edge Sync enables nodes to pull configuration or content from an external source.

Field	Description
Edge Sync URL	The URL of the external source from which nodes synchronize data.
Data Store	The data store configuration associated with the Edge Sync source.

Update Policies After Creation

Standard and Azure IoT projects

Open Infrastructure > Fleet > Projects and select the target project.
Select the Configure icon in the page header.
Select the Policies section.
Select or clear checkboxes to add or remove policies.
Modify policy configuration fields as needed.
Select Save.

Deployment projects

A Deployment project has no Policies section. Add a deployment record to change the policy set that tagged nodes receive.

Open Infrastructure > Fleet > Projects and select the target project.
Select the Configure icon in the page header.
Select Deployment Profile > Deployments.
Select Add Deployment, enter a Deployment Tag Name, select the policies to include, and configure each one.
Select Add Deployment to save the record.

See Manage Projects for the full procedure. Edge Infrastructure Services pushes policy updates to all nodes in the project the next time those nodes check in.

Next Steps

Manage Projects

View, update, or delete projects.

Onboard Nodes

Assign nodes to a project.

Networks

Full network field reference.

Applications

Full edge app and volume instance field reference.

Edge View and Remote Access

Full Edge View field reference.

Start Here

Infrastructure Services Overview

Core infrastructure

Build

Applications and delivery

Edge Kubernetes

Operations

Monitor

Administration and Security

Troubleshooting

Partnerships

Node Policy

Virtual Networks Policy

Volume Instance Policy

Edge Apps Policy

Edge View Policy

Access details

Session details

Edge Sync Policy

Update Policies After Creation

Standard and Azure IoT projects

Deployment projects

Next Steps

Manage Projects

Onboard Nodes

Networks

Applications

Edge View and Remote Access

​Node Policy

​Virtual Networks Policy

​Volume Instance Policy

​Edge Apps Policy

​Edge View Policy

​Access details

​Session details

​Edge Sync Policy

​Update Policies After Creation

​Standard and Azure IoT projects

​Deployment projects

​Next Steps

Manage Projects

Onboard Nodes

Networks

Applications

Edge View and Remote Access

Node Policy

Virtual Networks Policy

Volume Instance Policy

Edge Apps Policy

Edge View Policy

Access details

Session details

Edge Sync Policy

Update Policies After Creation

Standard and Azure IoT projects

Deployment projects

Next Steps