Dynamic Group for only Autopilot phase

Question

Current ZTDid rule keeps devices in the group after it has been applied by an user. I need a group syntax, which will keep device in the group only during Autopilot phase, but after it is applied on-field, the device would disappear. I've been playing around with (device.devicePhysicalIDs -any (_ -not contains "[USER-GID]")) but it has no effect.

Answer 1

@Pavel yannara Mirochnitchenko , I have connected to Azure AD via PowerShell using the following commands and check the device attributes:

I find the AccountEnable attribute is not the same before and after Autopilot enroll. Then I create a dynamic group with the following rule syntax and find only the Autopilot devices which are not enrolled will be added into this group:
(device.accountEnabled -eq false) and (device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))

We can try the same rule to see if it is working. Hope it can help.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 2

May I ask why? What is the end goal here?

Answer 3

@Pavel yannara Mirochnitchenko , We can use PowerShell to query the devices. Compare one device before the Autopilot phase and one after the phase to see which attribute is different. Then check if the attribute is included in the Dynamic membership rules for groups in Azure Active Directory to see if there's any rule can accomplish what we want:
https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

Hope it can help.

---

If the response is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.