'%3e%3cpath%20d='M8%200C12.4183%200%2016%203.58172%2016%208C16%2012.4183%2012.4183%2016%208%2016C3.58172%2016%200%2012.4183%200%208C0%203.58172%203.58172%200%208%200ZM11.6162%204.38379C11.2257%203.99337%2010.5927%203.99338%2010.2021%204.38379L8%206.58594L5.79785%204.38379C5.40732%203.99334%204.77429%203.99329%204.38379%204.38379C3.99331%204.77429%203.99335%205.40733%204.38379%205.79785L6.58594%208L4.38379%2010.2021C3.99348%2010.5927%203.99341%2011.2257%204.38379%2011.6162C4.77426%2012.0066%205.40734%2012.0065%205.79785%2011.6162L8%209.41406L10.2021%2011.6162C10.5927%2012.0066%2011.2257%2012.0067%2011.6162%2011.6162C12.0067%2011.2257%2012.0066%2010.5927%2011.6162%2010.2021L9.41406%208L11.6162%205.79785C12.0066%205.40735%2012.0066%204.77429%2011.6162%204.38379Z'%20fill='%23080E17'%20fill-opacity='0.46'/%3e%3c/g%3e%3cdefs%3e%3cclipPath%20id='clip0_3761_713'%3e%3crect%20width='16'%20height='16'%20fill='white'/%3e%3c/clipPath%3e%3c/defs%3e%3c/svg%3e)
How to Group Intune Devices by Enrollment Status
Question details
Administrators need to automatically categorize and group Microsoft Intune devices based on their specific enrollment method or status, such as Microsoft Entra joined or registered.
- Product
- Microsoft Intune
- Device & OS
- not provided
- Scenario
- Managing enterprise device inventories and applying targeted policies based on how the devices are enrolled and trusted within the network.
- Observed behavior
- The user is looking for the correct procedure, rules, and attributes to filter and organize devices automatically within the Microsoft Intune admin center.
Ensure you have global administrator or Intune administrator privileges in your Microsoft Entra ID (formerly Azure AD) tenant before attempting to create or modify dynamic device groups.
Use Dynamic Device Group Rules in Microsoft Entra
Create a dynamic group in Microsoft Entra ID using membership rules based on device enrollment properties.
To group devices automatically by their enrollment profile or status, you can utilize the dynamic membership rules in Microsoft Entra ID. Since syntax can vary based on your specific environment, Microsoft recommends verifying complex rules with Intune specialists in their official Q&A forums.
Navigate to the Microsoft Intune admin center in your browser and sign in with your administrator credentials.
Click on the 'Groups' tab in the left-hand navigation pane and select 'New group'.
Set the Group type to 'Security' and change the Membership type to 'Dynamic Device'.
Click on 'Add dynamic query' under dynamic device members. Configure the rule syntax to filter by enrollment profile name, device ownership, or device trust type (e.g., deviceTrustType -eq 'ServerAd' for hybrid joined).
For highly specific enrollment scenarios, post your environment details in the dedicated Microsoft Intune Microsoft Q&A forum where specialists can provide accurate rule syntax.
Looking for a Lightweight Office Suite for Managed Devices?
While you manage your enterprise devices with Microsoft Intune, consider deploying WPS Office as a free, lightweight, and highly compatible alternative to Microsoft Office. It helps reduce software licensing costs while maintaining full productivity for your workforce.
- 1. Download the Installer: Visit the official WPS Office website to download the latest enterprise or free version installer.
- 2. Deploy via Endpoint Management: Use your endpoint management tool, such as Microsoft Intune, to package and deploy the WPS Office application to your newly created dynamic device groups.
- 3. Enjoy Seamless Productivity: Allow your users to open, edit, and collaborate on Microsoft Office files effortlessly with full format compatibility.
Frequently Asked Questions
What are the common device enrollment status types in Microsoft Entra?
Common enrollment states include Microsoft Entra joined (formerly Azure AD joined), Microsoft Entra registered, and Microsoft Entra hybrid joined. Each state represents a different level of management control and network trust.
Can I use dynamic groups for policy assignment in Intune?
Yes, dynamic device groups in Microsoft Entra ID are highly recommended for assigning device configuration profiles, compliance policies, and endpoint security settings automatically based on device attributes.
Why is my dynamic device group not updating immediately after creation?
Dynamic group membership rules can take up to 24 hours to fully evaluate and populate across your tenant, especially in large enterprise environments. Always allow sufficient time for backend processes to complete.
