Dynamic Group for only Autopilot phase

Pavel Yannara Mirochnitchenko 6,911 Reputation points
2021-03-13T09:28:43.47+00:00

Current ZTDid rule keeps devices in the group after it has been applied by an user. I need a group syntax, which will keep device in the group only during Autopilot phase, but after it is applied on-field, the device would disappear. I've been playing around with (device.devicePhysicalIDs -any (_ -not contains "[USER-GID]")) but it has no effect.

Microsoft Intune Enrollment
Microsoft Intune Enrollment
Microsoft Intune: A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.Enrollment: The process of requesting, receiving, and installing a certificate.
844 questions
Microsoft Intune
Microsoft Intune
A Microsoft cloud-based management solution that offers mobile device management, mobile application management, and PC management capabilities.
2,077 questions
No comments
{count} votes

Accepted answer
  1. Crystal-MSFT 19,576 Reputation points Microsoft Employee
    2021-03-16T06:28:34.62+00:00

    @Pavel Yannara Mirochnitchenko , I have connected to Azure AD via PowerShell using the following commands and check the device attributes:

    78106-image.png
    I find the AccountEnable attribute is not the same before and after Autopilot enroll. Then I create a dynamic group with the following rule syntax and find only the Autopilot devices which are not enrolled will be added into this group:
    (device.accountEnabled -eq false) and (device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))
    78070-image.png

    We can try the same rule to see if it is working. Hope it can help.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


2 additional answers

Sort by: Most helpful
  1. Rahul Jindal [MVP] 6,161 Reputation points Microsoft MVP
    2021-03-14T22:59:21.617+00:00

    May I ask why? What is the end goal here?


  2. Crystal-MSFT 19,576 Reputation points Microsoft Employee
    2021-03-15T01:32:06.487+00:00

    @Pavel Yannara Mirochnitchenko , We can use PowerShell to query the devices. Compare one device before the Autopilot phase and one after the phase to see which attribute is different. Then check if the attribute is included in the Dynamic membership rules for groups in Azure Active Directory to see if there's any rule can accomplish what we want:
    https://learn.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership

    Hope it can help.


    If the response is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.