You can assign a policy directly to a device, or you can assign it to a folder or group in which the device is a member. As a general rule, you should try to assign policies to device groups rather than device folders.