# Dynamic Device Group for Company-Owned Windows Devices

<table class="MsoNormalTable" id="bkmrk-field-details-docume" style="width: 59.6429%;" title=""><tbody><tr><td style="width: 25.6757%;">**Field**

</td><td style="width: 74.3243%;">**Details**

</td></tr><tr><td style="width: 25.6757%;">Document Type

</td><td style="width: 74.3243%;">How-To Guide - Create a Dynamic Group Runbook

</td></tr><tr><td style="width: 25.6757%;">Applies To

</td><td style="width: 74.3243%;">Microsoft Entra ID &amp; Microsoft Intune

</td></tr><tr><td style="width: 25.6757%;">Audience

</td><td style="width: 74.3243%;">2nd Line, Entra ID &amp; Intune Admin

</td></tr><tr><td style="width: 25.6757%;">Author

</td><td style="width: 74.3243%;">AK. Udofeh

</td></tr><tr><td style="width: 25.6757%;">Last Updated

</td><td style="width: 74.3243%;">Nov 2025

</td></tr></tbody></table>

##### **Overview**

This document explains how to create a dynamic device group in Microsoft Entra ID (formerly Azure AD) that automatically includes all Company-owned Windows devices that are Microsoft Entra-Joined. This group can then be targeted for Intune policies.

##### **Key properties used**

- Devices: Windows 10 and Windows 11
- Enrollment: Manual Microsoft Entra join by users
- Ownership: Company (Corporate-owned)
- Management: Intune-managed (MDM)
- *Goal: Automatically group these devices without manual assignment.*

##### **Steps to Create the Dynamic Device Group**

- Sign in to Entra Admin Center
- Go to Intune Admin Center <span data-annotation-inline-node="true" data-annotation-mark="true" data-card-url="https://intune.microsoft.com/" data-inline-card="true" data-renderer-start-pos="617"><span class="loader-wrapper"><span class="hover-card-trigger-wrapper" data-testid="hover-card-trigger-wrapper">[<span class="_19itglyw _vchhusvi _r06hglyw _o5721jtm _1nmz9jpi _16d9qvcn _ca0qv77o _u5f31b66 _n3tdv77o _19bv1b66" data-testid="inline-card-icon-and-title"><span class="_19itglyw _vchhusvi _r06hglyw">Microsoft Intune admin center</span></span>](https://intune.microsoft.com/)</span></span></span>
- Navigate to Groups &gt; All Groups.
- Click + New Group.
- Group type: Security
- Group name: Corporate Windows Devices
- Membership type: Dynamic Device
- Add Dynamic Membership Rule
- Under Dynamic membership rules, click Edit.
- Choose Rule syntax and paste the following:

```powershell
 (device.deviceOSType -eq "Windows") and (device.trustType -eq "AzureAD") and (device.deviceOwnership -eq "Company") and (managementType -eq "MDM")
```

##### **Rule Breakdown**

- *device.deviceOSType -eq "Windows"* - Includes Windows devices only.
- *device.trustType -eq "AzureAD"* - Ensures the device is Microsoft Entra-Joined (not hybrid or registered only).
- *device.deviceOwnership -eq "Company"* - Filters for University-owned devices.
- *managementType -eq "MDM"* - Includes devices managed by MDM (Intune), excludes None and co-managed hybrid devices (MDM/AD) in most cases.

<p class="callout warning">***Limitation: Some co-managed or misreported devices may still appear; manual validation may be required.***</p>

##### **Validate and Save**

- Click **Validate Rules** to confirm matching devices.
- Save and create the group.

##### **Common Device Attributes &amp; Values**

<table data-layout="default" data-number-column="false" data-table-width="760" data-testid="renderer-table" id="bkmrk-property-value-meani" style="width: 100%;"><tbody><tr><td colspan="1" rowspan="1" style="width: 22.7652%;">**Property**

</td><td colspan="1" rowspan="1" style="width: 27.7668%;">**Value**

</td><td colspan="1" rowspan="1" style="width: 49.468%;">**Meaning**

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;">device.trustType

</td><td colspan="1" rowspan="1" style="width: 27.7668%;">AzureAD

</td><td colspan="1" rowspan="1" style="width: 49.468%;">Microsoft Entra joined (cloud-only)

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;"></td><td colspan="1" rowspan="1" style="width: 27.7668%;">ServerAD

</td><td colspan="1" rowspan="1" style="width: 49.468%;">Hybrid joined (on-prem AD + Entra)

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;"></td><td colspan="1" rowspan="1" style="width: 27.7668%;">Workplace

</td><td colspan="1" rowspan="1" style="width: 49.468%;">Registered only (personal/BYOD)

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;">device.deviceOwnership

</td><td colspan="1" rowspan="1" style="width: 27.7668%;">Company

</td><td colspan="1" rowspan="1" style="width: 49.468%;">Corporate-owned device

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;"></td><td colspan="1" rowspan="1" style="width: 27.7668%;">Personal

</td><td colspan="1" rowspan="1" style="width: 49.468%;">User-owned device

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;">device.deviceOSType

</td><td colspan="1" rowspan="1" style="width: 27.7668%;">Windows

</td><td colspan="1" rowspan="1" style="width: 49.468%;">Windows OS devices only

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;">managementType

</td><td colspan="1" rowspan="1" style="width: 27.7668%;">MDM

MDM/AD

Unknown

</td><td colspan="1" rowspan="1" style="width: 49.468%;">Managed via Intune or another MDM

Hybrid-managed

Not managed

</td></tr><tr><td colspan="1" rowspan="1" style="width: 22.7652%;">device.deviceCategory

</td><td colspan="1" rowspan="1" style="width: 27.7668%;">Type in your device category name

</td><td colspan="1" rowspan="1" style="width: 49.468%;">This depends on the category name that has been provisioned already

</td></tr></tbody></table>

<p class="callout info">Dynamic groups are evaluated automatically whenever device properties change.</p>

<p class="callout info">Ensure devices are marked as Company-owned during or after enrollment.</p>

<p class="callout info">Combine a broad dynamic device group with compliance/enrollment policies and manual validation to ensure only Intune-managed devices receive policies.</p>