# Microsoft Intune

This book section is for MS Intune related documentations

# Dynamic Device Group for Company-Owned Windows Devices

<table class="MsoNormalTable" id="bkmrk-field-details-docume" style="width:59.6429%;" title=""><tbody><tr><td style="width:25.6757%;">**Field**

</td><td style="width:74.3243%;">**Details**

</td></tr><tr><td style="width:25.6757%;">Document Type

</td><td style="width:74.3243%;">How-To Guide - Create a Dynamic Group Runbook

</td></tr><tr><td style="width:25.6757%;">Applies To

</td><td style="width:74.3243%;">Microsoft Entra ID &amp; Microsoft Intune

</td></tr><tr><td style="width:25.6757%;">Audience

</td><td style="width:74.3243%;">2nd Line, Entra ID &amp; Intune Admin

</td></tr><tr><td style="width:25.6757%;">Author

</td><td style="width:74.3243%;">AK. Udofeh

</td></tr><tr><td style="width:25.6757%;">Last Updated

</td><td style="width:74.3243%;">Nov 2025

</td></tr></tbody></table>

##### **Overview**

This document explains how to create a dynamic device group in Microsoft Entra ID (formerly Azure AD) that automatically includes all Company-owned Windows devices that are Microsoft Entra-Joined. This group can then be targeted for Intune policies.

##### **Key properties used**

- Devices: Windows 10 and Windows 11
- Enrollment: Manual Microsoft Entra join by users
- Ownership: Company (Corporate-owned)
- Management: Intune-managed (MDM)
- *Goal: Automatically group these devices without manual assignment.*

##### **Steps to Create the Dynamic Device Group**

- Sign in to Entra Admin Center
- Go to Intune Admin Center <span><span class="loader-wrapper"><span class="hover-card-trigger-wrapper">[<span class="_19itglyw _vchhusvi _r06hglyw _o5721jtm _1nmz9jpi _16d9qvcn _ca0qv77o _u5f31b66 _n3tdv77o _19bv1b66"><span class="_19itglyw _vchhusvi _r06hglyw">Microsoft Intune admin center</span></span>](https://intune.microsoft.com/)</span></span></span>
- Navigate to Groups &gt; All Groups.
- Click + New Group.
- Group type: Security
- Group name: Corporate Windows Devices
- Membership type: Dynamic Device
- Add Dynamic Membership Rule
- Under Dynamic membership rules, click Edit.
- Choose Rule syntax and paste the following:

```powershell
 (device.deviceOSType -eq "Windows") and (device.trustType -eq "AzureAD") and (device.deviceOwnership -eq "Company") and (managementType -eq "MDM")
```

##### **Rule Breakdown**

- *device.deviceOSType -eq "Windows"* - Includes Windows devices only.
- *device.trustType -eq "AzureAD"* - Ensures the device is Microsoft Entra-Joined (not hybrid or registered only).
- *device.deviceOwnership -eq "Company"* - Filters for University-owned devices.
- *managementType -eq "MDM"* - Includes devices managed by MDM (Intune), excludes None and co-managed hybrid devices (MDM/AD) in most cases.

<p class="callout warning">***Limitation: Some co-managed or misreported devices may still appear; manual validation may be required.***</p>

##### **Validate and Save**

- Click **Validate Rules** to confirm matching devices.
- Save and create the group.

##### **Common Device Attributes &amp; Values**

<table id="bkmrk-property-value-meani" style="width:100%;"><tbody><tr><td colspan="1" rowspan="1" style="width:22.7652%;">**Property**

</td><td colspan="1" rowspan="1" style="width:27.7668%;">**Value**

</td><td colspan="1" rowspan="1" style="width:49.468%;">**Meaning**

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;">device.trustType

</td><td colspan="1" rowspan="1" style="width:27.7668%;">AzureAD

</td><td colspan="1" rowspan="1" style="width:49.468%;">Microsoft Entra joined (cloud-only)

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;"></td><td colspan="1" rowspan="1" style="width:27.7668%;">ServerAD

</td><td colspan="1" rowspan="1" style="width:49.468%;">Hybrid joined (on-prem AD + Entra)

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;"></td><td colspan="1" rowspan="1" style="width:27.7668%;">Workplace

</td><td colspan="1" rowspan="1" style="width:49.468%;">Registered only (personal/BYOD)

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;">device.deviceOwnership

</td><td colspan="1" rowspan="1" style="width:27.7668%;">Company

</td><td colspan="1" rowspan="1" style="width:49.468%;">Corporate-owned device

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;"></td><td colspan="1" rowspan="1" style="width:27.7668%;">Personal

</td><td colspan="1" rowspan="1" style="width:49.468%;">User-owned device

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;">device.deviceOSType

</td><td colspan="1" rowspan="1" style="width:27.7668%;">Windows

</td><td colspan="1" rowspan="1" style="width:49.468%;">Windows OS devices only

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;">managementType

</td><td colspan="1" rowspan="1" style="width:27.7668%;">MDM

MDM/AD

Unknown

</td><td colspan="1" rowspan="1" style="width:49.468%;">Managed via Intune or another MDM

Hybrid-managed

Not managed

</td></tr><tr><td colspan="1" rowspan="1" style="width:22.7652%;">device.deviceCategory

</td><td colspan="1" rowspan="1" style="width:27.7668%;">Type in your device category name

</td><td colspan="1" rowspan="1" style="width:49.468%;">This depends on the category name that has been provisioned already

</td></tr></tbody></table>

<p class="callout info">Dynamic groups are evaluated automatically whenever device properties change.</p>

<p class="callout info">Ensure devices are marked as Company-owned during or after enrollment.</p>

<p class="callout info">Combine a broad dynamic device group with compliance/enrollment policies and manual validation to ensure only Intune-managed devices receive policies.</p>

# HOW TO: Join a Windows Computer to Microsoft Intune

<table class="MsoNormalTable" id="bkmrk-field-details-docume" style="width:80.119%;" title=""><tbody><tr><td style="width:25.7143%;">**Field**

</td><td style="width:74.2857%;">**Details**

</td></tr><tr><td style="width:25.7143%;">Document Type

</td><td style="width:74.2857%;">How-To Guide - Join a Windows Computer to MS Intune Runbook

</td></tr><tr><td style="width:25.7143%;">Applies To

</td><td style="width:74.2857%;">Microsoft Entra ID &amp; Microsoft Intune

</td></tr><tr><td style="width:25.7143%;">Audience

</td><td style="width:74.2857%;">2nd Line, Entra ID &amp; Intune Admin

</td></tr><tr><td style="width:25.7143%;">Author

</td><td style="width:74.2857%;">AK. Udofeh

</td></tr><tr><td style="width:25.7143%;">Last Updated

</td><td style="width:74.2857%;">Nov 2025

</td></tr></tbody></table>

##### **Overview**

This guide details the steps to follow to join a Company-owned Windows computer to Entra ID (formerly known as Azure AD). Joining a device to Microsoft Entra ID enables a secure Single Sign-On (SSO) experience to Corporate Apps, policy-based device management via Intune, and access controls via Entra ID Conditional Access Policy. It also allows Administrators to enforce compliance, manage updates, and remotely wipe lost or stolen devices.

<p class="callout info">The device must be Windows 10 or 11 Pro, Enterprise or Education. The device must have internet access to reach Microsoft Entra services during the join process. User must sign in with the Organisation's account, and the account must have permissions to join devices.</p>

<p class="callout warning">If another MDM agent (or on-prem AD join with GPO) is active, joining may fail or cause conflicts.</p>

<p class="callout info">Your old workgroup profile will be separate from the new Entra ID profile, and some personalisation may be lost. As such, you may want to move your data in the Downloads, Documents, and Desktop folders and export your Internet browser bookmarks, saved passwords and store the backup files in OneDrive or Box Cloud Storage before starting the device join process.</p>

<p class="callout info">You may have to install Company Portal from Microsoft Store if it is not already installed on your device.</p>

<p class="callout success">**Bonus:** You may want to follow these links for a guide on how to export and restore your browser bookmarks and saved passwords.</p>

<p class="callout success">[HO<span><span class="css-bjn8wh"><span class="loader-wrapper"><span class="hover-card-trigger-wrapper"><span class="_19itglyw _vchhusvi _r06hglyw _o5721jtm _1nmz9jpi _16d9qvcn _ca0qv77o _u5f31b66 _n3tdv77o _19bv1b66"><span class="_19itglyw _vchhusvi _r06hglyw">W TO: Export &amp; Import Microsoft Edge Browser Password</span></span></span></span></span></span>](https://docs.aktechnoservices.com/books/web-browser-tasks/page/how-to-export-import-microsoft-edge-browser-password)</p>

<p class="callout success">[<span><span class="css-bjn8wh"><span class="loader-wrapper"><span class="hover-card-trigger-wrapper"><span class="_19itglyw _vchhusvi _r06hglyw _o5721jtm _1nmz9jpi _16d9qvcn _ca0qv77o _u5f31b66 _n3tdv77o _19bv1b66"><span class="_19itglyw _vchhusvi _r06hglyw">HOW TO: Export &amp; Import Microsoft Edge Browser Bookmarks</span></span></span></span></span></span>](https://docs.aktechnoservices.com/books/web-browser-tasks/page/how-to-export-import-microsoft-edge-browser-bookmarks)</p>

<p class="callout success">[HOW TO: Export &amp; Import Chrome Browser Passwords](https://docs.aktechnoservices.com/books/web-browser-tasks/page/how-to-export-import-chrome-browser-passwords)</p>

<p class="callout success">[HOW TO: Export &amp; Import Chrome Browser Bookmarks](https://docs.aktechnoservices.com/books/web-browser-tasks/page/how-to-export-import-chrome-browser-bookmarks)</p>

**Step 1:** Click the Start menu on the Taskbar &gt; type “Company Portal” in the search bar and click on the Company Portal App to open.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/CAFimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/CAFimage.png)

**Step 2:** Click “Sign in”.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/mwtimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/mwtimage.png)

**Step 3:** Type in your username and click Next.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/b42image.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/b42image.png)

**Step 4:** Type in your password and click Sign in.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/3Orimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/3Orimage.png)

**Step 5:** Type in the number shown into your Authenticator App to verify your log in.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/pBJimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/pBJimage.png)

**Step 6:** Click “Yes” to register your device with Entra ID.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/dtyimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/dtyimage.png)

**Step 7:** Click “Yes” to enrol your device for management in Intune.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/8zWimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/8zWimage.png)

**Step 8:** Allow the registration process to complete

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/Aidimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/Aidimage.png)

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/MAKimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/MAKimage.png)

**Step 9:** Select the category for this device (if unsure, please reach out to Helpdesk)

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/VQmimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/VQmimage.png)

**Step 10:** Device enrolment successfully completed.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/EGgimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/EGgimage.png)

**Step 11:** You will need to "switch users" to log in to your new Organisation's account on your device. Click “Start” Menu &gt; click your current user account &gt; click three-dot menu &gt; click “Switch user”.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/Vbyimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/Vbyimage.png)

**Step 12:** Click “Other user” to sign in with your Organisation's domain account.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/xs3image.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/xs3image.png)

**Step 13:** Type in your Organisation's domain account and password.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/Ov7image.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/Ov7image.png)

**Step 14:** Viola, you’re now in.

[![image.png](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/scaled-1680-/iJcimage.png)](https://docs.aktechnoservices.com/uploads/images/gallery/2026-03/iJcimage.png)