Device Groups and Dynamic Membership Rules

What it is

Policies, apps and updates are assigned to groups. For devices, you use Microsoft Entra security groups that either have assigned members or dynamic members chosen by a rule. A group of devices gets settings no matter who signs in, while a group of users follows the person across devices. Good group design makes every later assignment simpler.

How it works

Assigned and dynamic groups

Dynamic groups require Microsoft Entra ID P1. A dynamic group contains either users or devices, never both. Membership is not instant. It is evaluated by the service, so a device can wait minutes, sometimes longer, to appear. For rollouts that must be applied at once, an assigned group or enrollment time grouping is more reliable.

Writing dynamic device rules

A rule compares a device property with a value.

(device.deviceOwnership -eq "Company") and (device.deviceOSType -eq "Windows")
(device.deviceCategory -eq "Frontline")
(device.enrollmentProfileName -eq "Kiosk Profile")
(device.devicePhysicalIds -any (_ -contains "[OrderID]:Marketing"))
(device.displayName -startsWith "LAB-")

Use -eq, -ne, -startsWith, -contains, -in and -match, and combine rules with -and and -or. The Validate rules option in the portal tests a rule against sample devices.

Device categories

A device category is a label such as Nursing or Marketing. Users on iOS, Android and Windows personal devices can choose one during enrollment through the Company Portal, and an admin can set it on any device. Create categories under Devices, Organize devices, Device categories. A dynamic device group with (device.deviceCategory -eq "Nursing") then collects those devices, so a Wi-Fi profile for nursing staff can target them automatically. Creating, editing or deleting categories can be protected by Multi Admin Approval.

Device groups or user groups

For compliance, deploying to devices gives clearer reporting. For apps, deploy to users when the app belongs to the person, and to devices when it belongs to the machine, such as a kiosk app.

Planning groups

• Use naming conventions that show purpose, such as DEV-Win-Corp-Pilot.
• Keep a pilot group and assign new policies to it first.
• Avoid overlapping rules that cause conflicting assignments. Use exclude assignments sparingly.
• Dynamic groups cannot contain nested groups. An assigned group can contain other groups, though not every Intune assignment supports nesting equally.
• Groups for Autopilot: a dynamic rule on the group tag places a device in the right group once it is registered.

A worked scenario

An IT team wants every company owned Windows laptop to get the baseline policy, and a pilot of 20 devices to receive updates first. They create a dynamic group with (device.deviceOwnership -eq "Company") and (device.deviceOSType -eq "Windows") for the baseline, and an assigned group named Pilot-Updates for the pilot. The retail stores use a device category called Store, and a dynamic rule on deviceCategory collects those devices for the store Wi-Fi profile.