Manage and maintain devices · Topic 6 of 9
Assignment Filters and Enrollment Time Grouping
MD-102 targeting: create assignment filters with include and exclude modes, and use enrollment time grouping to put devices in groups at enrollment.
- 4 min
- A filter narrows an assignment by device properties, in Include or Exclude mode, and is evaluated at check in.
- Filters need a group or virtual group, and not every policy type supports them.
- Enrollment time grouping uses a static security group chosen in the enrollment profile.
What it is
Intune assigns policies, profiles and apps to groups. Two features make targeting more precise. An assignment filter narrows an assignment by device properties, such as model or OS version, without creating more groups. Enrollment time grouping adds a device to a group at the moment it enrolls, so policies arrive without waiting for a dynamic group to calculate.
How it works
Assignment filters
A filter is a rule you build under Devices, Organize devices, Filters. You choose the platform and write a rule (with the rule builder or rule syntax). When you assign a policy, you pick a group and then a filter, and decide whether to use it in Include or Exclude mode.
Common properties:
| Property | Example |
|---|---|
| deviceOwnership | Corporate or Personal |
| osVersion | Greater than or equal to a version |
| manufacturer and model | Dell, Surface Laptop 5 |
| deviceName | Starts with LAB |
| enrollmentProfileName | The Autopilot or Apple profile name |
| operatingSystemSKU | Enterprise, Pro |
Example rule: (device.manufacturer -eq "Dell Inc.") and (device.osVersion -ge "10.0.22631").
How filters behave:
- Include applies the assignment only to devices that match. Exclude applies it to all devices in the group except those that match.
- Filters are evaluated when the device checks in, so a change in a property can add or remove the assignment later.
- They work with compliance policies, configuration profiles, apps, app protection and app configuration policies and others, on supported platforms. Not every policy type supports filters, so check the supported workload list.
- A filter cannot be applied on its own. It always needs a group (or the All users and All devices virtual groups).
- You can preview which devices a filter matches before using it.
- Exclusion groups are not needed for the same job, so you avoid overlapping groups.
Filters are the better choice than extra dynamic groups when you only need to carve out a property inside an existing assignment, such as installing an app on all corporate devices except virtual machines.
Enrollment time grouping
Enrollment time grouping puts a device into a static Microsoft Entra security group during enrollment, based on the enrollment profile. Policies, apps and scripts assigned to that group then deploy right away, which is faster and more reliable than a dynamic group that must wait for evaluation.
| Platform | How it is set |
|---|---|
| Windows Autopilot device preparation | Choose the device group in the policy. The Intune Provisioning Client must be the group owner |
| Apple automated device enrollment | Pick a device group in the enrollment profile |
| Android Enterprise corporate enrollment | Pick a device group in the enrollment profile |
Points to know:
- The group must be a static (assigned) security group, not a dynamic one.
- Only the apps and scripts you select in the Autopilot device preparation policy install during OOBE. Others assigned to the group install after.
- Policies assigned to the group sync, but device preparation does not track whether they have applied during the deployment.
- Use it when you need a pilot or a role specific device set to receive configuration immediately.
Filters or enrollment time grouping
| Need | Choose |
|---|---|
| Apply a policy to devices in a group except one model | Assignment filter (exclude) |
| Give new devices their policies as soon as they enroll | Enrollment time grouping |
| Group devices that already exist by an attribute | Dynamic device group |
A worked scenario
A company wants a Wi-Fi profile on all corporate laptops, but not on virtual machines, and a security agent only on Windows 11. The admin assigns the Wi-Fi profile to All devices with an exclude filter for device.model -eq "Virtual Machine", and the agent to the corporate group with an include filter on osVersion. Autopilot device preparation devices go to a static group owned by the Intune Provisioning Client so the agent installs during setup.
What to remember for the exam
- A filter narrows an assignment by device properties, in Include or Exclude mode, and is evaluated at check in.
- Filters need a group or virtual group, and not every policy type supports them.
- Enrollment time grouping uses a static security group chosen in the enrollment profile.
- For Autopilot device preparation, the Intune Provisioning Client must own the group.
- A dynamic group has a delay, so enrollment time grouping is faster.
A scenario with a model or OS version carve out points to an assignment filter, not a new group.
How the exam asks about this
- "Deploy a profile to all devices except Surface Pro devices." An exclude assignment filter.
- "Devices must receive apps during setup, not after a dynamic group updates." Enrollment time grouping.
- "Which group type does enrollment time grouping use?" A static security group.
- "Which service must own the group in device preparation?" The Intune Provisioning Client.
Common mistakes
Assigning only a filter. It always needs a group.
Using a dynamic group for enrollment time grouping. It must be static.
Forgetting the group owner. Devices are not added.
Treating filter results as live. They update at check in.
Check yourself
When is an assignment filter evaluated?
When the device checks in.
What kind of group does enrollment time grouping use?
A static Microsoft Entra security group.
Which mode applies an assignment to everything except matching devices?
Exclude.
Topic 6 of 9 in Manage and maintain devices
Test yourself on Manage and maintain devices
The full Microsoft MD-102 question bank has 658 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by Microsoft. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.