I need to add Dynamic user groups in Assignments for our LAPs deployment in Intune

Muhammad Zeeshan 100

I need to add Dynamic user groups in Assignments for our LAPs deployment for Intune should that work because we don't have dynamic devices groups in Intune

5 answers

Aleksandr Kolesnikov 486 Reputation points

2024-09-02T13:46:18.1333333+00:00

Hi @Muhammad Zeeshan

According to Microsoft's description, they recommend user device groups but are not limited to that.

For Assignments, select the groups to receive this policy. We recommend assigning LAPS policy to device groups. Policies assigned to user groups follow a user from device to device. When the user of a device changes, a new policy might apply to the device and introduce inconsistent behavior, including which account the device backs up or when the managed accounts password is next rotated.

Refer to Create a LAPS policy

Best regards,

Aleksandr

If the response is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
ZhoumingDuan-MSFT 12,415 Reputation points Microsoft Vendor

2024-09-03T01:21:42.6533333+00:00

@Muhammad Zeeshan, Thanks for posting in Q&A.

From your description, I know you want to create a dynamic user group and apply to LAPS policy assignment.

Based on my research, here is a link about how to create Dynamic membership rules for groups in Microsoft Entra ID.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

However, as @Aleksandr Kolesnikov mentioned, Microsoft official document recommend use device groups, so it is suggested that you create a dynamic device group and apply it to LAPS policy.

For creating dynamic device group, you can refer the link below.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#rules-for-devices

Hope above information can be helpful.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Muhammad Zeeshan 100 Reputation points

2024-09-03T06:18:57.99+00:00

Hi @ZhoumingDuan-MSFT @Aleksandr Kolesnikov Actually i don't have dynamic devices groups, we only have uses dynamic groups as per different physical location .
Now what i need i want to deploy LAPS on region(Location) basis so how i can apply laps policy on location basis on devices like we have 20 dynamic user groups (Location base) and i need to deploy LAPS on devices on location basis in chunks as per instructions
Please sign in to rate this answer.
ZhoumingDuan-MSFT 12,415 Reputation points Microsoft Vendor

2024-09-03T07:01:12.8033333+00:00

@Muhammad Zeeshan, Thanks for your reply.

If you want to assign dynamic user group to LAPS policy based on devices' location, we can configure usageLocation property to identify different locations of user's usage, then when you want to some specific locations' devices apply LAPS policy you can add the relate dynamic user group

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#properties-of-type-string

Please note that if you use dynamic user group, only when the user login in device, the LAPS policy will be applied.

Muhammad Zeeshan 100 Reputation points

2024-09-03T07:08:54.7966667+00:00

So is it possible to create dynamic groups using current dynamic user location group like we have two locations Norway -users Germany -users

so i wan to create device groups Norway devices instead of adding manual

ZhoumingDuan-MSFT 12,415 Reputation points Microsoft Vendor

2024-09-03T07:51:07.5033333+00:00

@Muhammad Zeeshan, Thanks for your reply.

Based on my research, there is no such setting about location in dynamic device group syntax, but you can use dynamic user group to achieve your goal.

However, you can create a dynamic device group to contain all enrolled devices, then create a filter to exclude devices not on Norway and Germany, after that, only device in Norway and Germany can apply the LAPS policy.

ZhoumingDuan-MSFT 12,415 Reputation points Microsoft Vendor

2024-09-05T06:33:46.9633333+00:00

@Muhammad Zeeshan, Hope you have a good day.

I am kindly following up to see if you have any remaining questions or concerns for this issue. Please note that we are always standby to support. Please feel free to reach us if any questions or concerns you may have.

ZhoumingDuan-MSFT 12,415 Reputation points Microsoft Vendor

2024-09-11T07:27:43.1433333+00:00

@Muhammad Zeeshan, Hope you have a good day.

I am currently standing by for further update from you and would like to know how things are going. If you have any questions or concerns on the recent information I've provided you, please don't hesitate to let me know.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Aleksandr Kolesnikov 486 Reputation points

2024-09-03T06:32:41.16+00:00
Hi @Muhammad Zeeshan

You can assign to your 20 dynamic user groups. Just keep in mind that policy settings applied to user groups always go with the user, and go with the user when signed in to their many devices.

In this case try to apply filters to target devices with a specific OS version or a specific manufacturer, target only personal devices or only organization-owned devices, and more.

Also, have a look at the Scope tags. It might be useful for you.

Scope tags are a great way to filter policies to specific groups, such as US-NC IT Team or JohnGlenn_ITDepartment. For more information, go to Use RBAC and scope tags for distributed IT.

Best regards,

Aleksandr

If the response is helpful, please click "Accept Answer" and upvote it.
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.
Muhammad Zeeshan 100 Reputation points

2024-09-03T07:04:59.5466667+00:00

So is it possible to create dynamic groups using current dynamic user location group
like we have two locations
Norway -users
Germany -users

so i wan to create device groups Norway devices instead of adding manual
Please sign in to rate this answer.
Aleksandr Kolesnikov 486 Reputation points

2024-09-03T07:14:59.92+00:00

If you have already dynamic user group with users from Norway and group with users from Germany, you can use them for assignment.

Policy will be applied to all users' devices.

Muhammad Zeeshan 100 Reputation points

2024-09-03T07:18:39.0633333+00:00

but if i use dynamic user group, only when the user login in device, the LAPS policy will be applied.
so i want to create dynamic devices group using existing dynamic user location groups is their any solution

Aleksandr Kolesnikov 486 Reputation points

2024-09-03T15:35:21.54+00:00

Sorry, but couldn't get why you need a device group.

only when the user login in device, the LAPS policy will be applied

Correct, is this an issue for your environment?

Creating a group with devices according to your users from a dynamic group location basis is only possible with a script.

I have created one for you:

Connect-MgGraph -Scopes "DeviceManagementManagedDevices.Read.All", "GroupMember.ReadWrite.All" # Define the dynamic group ID and the target group ID where devices will be added $dynamicGroupId = "" $targetGroupId = "" # Get the members of the dynamic group $members = Get-MgGroupMemberAsUser -GroupId $dynamicGroupId -All -ConsistencyLevel eventual # Loop through each member foreach ($user in $members) { # Check if the member is a user and has a UserPrincipalName # Get the managed device for the user $devices = Get-MgUserOwnedDevice -UserId $user.Id | where {(($_.AdditionalProperties.managementType -eq "MDM") -and ($_.AdditionalProperties.deviceOwnership -eq "Company")) -and ($_.AdditionalProperties.isCompliant -eq $true)} # If a device is found, add the AzureAdDeviceId to the target group foreach ($device in $devices) { if ($device.Id) { # Add the device to the group try { New-MgGroupMember -GroupId $targetGroupId -DirectoryObjectId $device.Id -ErrorAction Stop Write-Host "Device with AzureAdDeviceId '$($device.AdditionalProperties.displayName)' added to group '$targetGroupId'" } catch { Write-Host "Failed to add device '$($device.AdditionalProperties.displayName)' to group '$targetGroupId': $_" } } else { Write-Host "No managed device found for user '$($user.UserPrincipalName)'" } } }

The script uses the Connect-MgGraph cmdlet to authenticate with appropriate permissions (DeviceManagementManagedDevices.Read.All, GroupMember.ReadWrite.All).

Best regards,

Aleksandr

If the response is helpful, please click "Accept Answer" and upvote it.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

I need to add Dynamic user groups in Assignments for our LAPs deployment in Intune

5 answers

Your answer