Intune Policies group assignment and exclusions

Question

Hey All,

I have an intune bitlocker policy. I generally apply the policies using user groups, but I am also using Windows 365 cloud PCs. So a user can have both a laptop or a windows 365 cloud pc. The issue I have is that when applying the bitlocker policy I only want it to apply to a user's physical device and not to the cloud PC.

Is there are way to assign the policy using user based groups, but then have the policy exclude for specific devices that that users of that policy logs on to. So basically only applying to physical devices and not to Windows 365 cloud PCs while using user based security groups?

Thanks

Answer 1

@Jason P, Thanks for posting in Q&A.

For your issue, we can create a filter that contains only Windows cloud PCs, and when we apply Intune policy to the device group, we can add a filter to exclude Windows cloud devices and have the policy apply only to physical devices.

Please note that if you want to use filters, we recommend that you assign the policy to a device group rather than a user group.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters-device-properties

Hope it will help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.