How to Create an Intune Dynamic Device Group Based on User Membership
Question details
The user wants to create a dynamic device group in Microsoft Intune that includes devices owned by members of a specific dynamic user group in order to apply administrative policies.
- Product
- Microsoft Intune / Microsoft Entra ID
- Device & OS
- not provided
- Scenario
- Applying administrative policies and restrictions to specific devices based on their owners' membership in a dynamic user group.
- Observed behavior
- Dynamic Microsoft Entra device-group rules cannot directly evaluate or query membership in another dynamic user group.
Ensure you have the necessary administrative privileges in Microsoft Intune and Microsoft Entra ID (formerly Azure AD) to manage groups, assign policies, and configure device filters.
Use Alternative Group Targeting Strategies in Intune
Since Microsoft Entra ID does not support creating dynamic device groups based on dynamic user group membership directly, you must use alternative targeting approaches.
Dynamic Microsoft Entra device-group rules cannot evaluate or query the membership of another user group. Instead of attempting to nest dynamic groups or cross-reference device and user properties directly, administrators should rely on alternative targeting methods natively supported by Intune.
Instead of creating a separate device group, assign your Intune configuration policies or app deployments directly to the dynamic user group. Intune will automatically apply these policies to the devices enrolled by those users.
To prevent user-targeted policies from applying to personal devices, apply the policy to the dynamic user group and use Intune device filters to include or exclude specific device properties (e.g., filtering for Corporate-owned devices only).
If your environment requires highly specific policy targeting that filters cannot solve, post your scenario in Microsoft Q&A under the Intune general topic to get guidance on proper Intune group design from Microsoft experts.
Deploy WPS Office Across Your Managed Devices
While managing policies and device groups in Microsoft Intune, consider deploying WPS Office as your default productivity suite. It offers a lightweight, highly compatible alternative to Microsoft Office that is easy to deploy across managed enterprise environments.
- 1. Download the Deployment Package: Visit the official WPS Office website to download the enterprise installation package suitable for mass deployment.
- 2. Upload to Microsoft Intune: Add the WPS Office package to your Microsoft Intune admin center as a line-of-business or Win32 app.
- 3. Assign to User or Device Groups: Assign the application deployment to your preferred dynamic user or device groups for seamless background installation.
Frequently Asked Questions
Can I nest a dynamic user group inside a dynamic device group in Azure AD?
No, Azure AD (Microsoft Entra ID) does not support nesting dynamic groups. A dynamic device rule cannot query a user group's membership to populate devices.
How should I target policies if I cannot group devices by user membership?
The recommended practice is to assign your Intune policies directly to the dynamic user group, and then use Intune device filters to restrict the policy application to specific devices (such as corporate-owned Windows PCs).
Does Intune support targeting user groups for device configuration profiles?
Yes, many device configuration profiles can be targeted to user groups. The policy will automatically apply to any compatible device the targeted user enrolls or signs into.
