Dynamic Group Based on Enrollment Profile in Intune

A dynamic group membership updates automatically based on defined rules. You can create attribute-based rules to update the group membership. You can create a dynamic group in Entra ID for users or devices. However, you can’t create a rule that contains both the user and the device. You an add multiple membership rules in a dynamic device group.

In this article, we will explain how to create azure AD dynamic group / Intune dynamic device group based on device enrolment profile. You can have multiple enrolment profiles for different user groups or departments based on business requirements. The business units may also need different applications and configurations for different set of users.

You can create Azure dynamic group based on enrolment profiles and assign Microsoft Intune applications, device configuration, device restriction, and other policies on that Azure AD/Entra ID group. This automate the administration and no manual intervention is required for the device once enrolled. You can create dynamic groups for Windows Autopilot enrolment profiles, iOS Automated device enrolment (ADE) profiles, and Android enrolment profiles.

How to Create Dynamic Group Based on Enrollment Profile in Entra ID

Follow the below steps to create a dynamic group based on the device enrollment profile name.

  • Open Microsoft Intune admin center and navigates to Groups blade.
  • Click on All Groups > New group

Entra ID dynamic group based on enrollment profile

  • In the New Group page, provide the following details.
    • Group Type: Security
    • Group Name: Provide a meaningful name for the group
    • In the Membership type, select Dynamic Device
    • Click on Add dynamic query

Azure AD dynamic group

  • In the Dynamic membership rules page, add the following query builder rules.
    • Property : EnrollmentProfileName
    • Operator: Equals
    • Value: Enter enrolment profile name
    • Click on Save

You can also add additional membership rules. For example, an enrolment profile was used for iOS/iPadOS devices. However, in a dynamic group, you only want to have the iPad. in that case, you can add another rule “deviceOSversion = iPadOS”.

Dynamic membership rules | Entra ID | Azure AD

Back to the New Group page, click on the Create button to create the Entra ID group.

Entra ID group

  • You can now see the newly created group in Entra ID Groups.

Entra ID group

Sample Membership Rules for Dynamic Groups Based on Enrollment Profile Name

Entra ID dynamic group where device enrollment profile is “Production Floor Supervisors” and device type is iPad

(device.enrollmentProfileName -eq "Production Floor Supervisors") and (device.deviceOSType -eq "iPad")

Entra ID dynamic group where device enrollment profile is “Production Floor Supervisors” and device type is iPhone

(device.enrollmentProfileName -eq "Production Floor Supervisors") and (device.deviceOSType -eq "iPhone")

Dynamic membership rules for profile name start with “Safety Inspections” and device type is either iPhone or iPad

(device.enrollmentProfileName -startsWith "Safety Inspections") and ((device.deviceOSType -eq "iPad") or (device.deviceOSType -eq "iPhone"))

Dynamic membership rules for profile name start with “Field Supervisors” and device type is AndroidForWork

(device.enrollmentProfileName -startsWith "Field Supervisors") and (device.deviceOSType -eq "AndroidForWork")

Related Posts


Subscribe to Techuisitive Newsletter

Be the first to know about our new blog posts. Get our newsletters directly in your inbox and stay up to date about Modern Desktop Management technologies & news.


Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top