Today I was creating a dynamic device group for my Autopilot machines that will only let devices coming from a specific Enrollment profile in Microsoft Intune > Device enrollment – Windows enrollment > Windows Autopilot deployment profiles.
The property “EnrollmentProfileName” looks both from DEP profile and Autopilot profile – So instead of looking at the psychicalID you can look at the EnrollmentProfileName from your Deployment Profiles from either Autopilot or DEP.
(device.enrollmentProfileName -eq "BPUserDriven")

Findings
I used the property “EnrollmentProfileName” with the operator “Equals” and the value “BP User Driven” – This is where it gets