Your organization uses Windows Autopilot device preparation policies for user-driven deployment. You want certain devices to automatically receive a specific set of configuration profiles the moment they enroll, without relying on dynamic group membership that can take time to populate. During policy creation you need devices to be placed into a static Entra security group at enrollment so targeting is immediate. Which capability should you configure to achieve this?