Question

Contoso deploys a Wi-Fi configuration profile to the 'All Corporate Windows Devices' group. However, a specific line of Surface Go tablets used only in warehouses must NOT receive this profile because they use a different network. You do not want to create a separate group or restructure existing assignments. What is the most efficient way to prevent the Surface Go devices from receiving the profile?

Accepted Answer

Create an assignment filter based on the device model property and apply it in 'Exclude' mode on the profile assignment

Answer

Add the Surface Go devices to a static Entra ID group and set that group as an excluded assignment on the profile

Answer

Create a dynamic device group with a membership rule targeting the Surface Go model and assign the profile to 'All Corporate Windows Devices' minus that group manually

Answer

Use enrollment-time grouping to tag the Surface Go devices during Autopilot so they are placed in a separate profile scope