Dynamic device group with Simple Rule – EnrollmentProfileName

Today I was creating a dynamic device group for my Autopilot machines that will only let devices coming from a specific Enrollment profile in Microsoft Intune > Device enrollment – Windows enrollment > Windows Autopilot deployment profiles.

The property “EnrollmentProfileName” looks both from DEP profile and Autopilot profile – So instead of looking at the psychicalID you can look at the EnrollmentProfileName from your Deployment Profiles from either Autopilot or DEP.

(device.enrollmentProfileName -eq "BPUserDriven")

Findings

I used the property “EnrollmentProfileName” with the operator “Equals” and the value “BP User Driven” – This is where it gets strange, if you make a value that is equal to your EnrollmentProfileName with “spaces” the dynamic group won’t work. The solution is to not name your Deployment Profiles with spaces and separators. 

Links

• Dynamic membership rules for groups in Azure Active Directory