Contoso wants a Microsoft Entra dynamic device group that automatically includes only devices that are actively managed by Microsoft Intune, so they can target a configuration profile to those devices. Which dynamic membership rule should the administrator use?