Question

Contoso wants to automatically group all corporate Windows devices that are managed by Intune into a single security group used for Conditional Access policy targeting. Personal (BYOD) or unmanaged devices must never appear in the group, and no administrator should have to add or remove devices manually. Which approach should you implement?

Accepted Answer

Create a dynamic device group with the rule (device.deviceOSType -eq "Windows") -and (device.isManaged -eq true) -and (device.deviceOwnership -eq "Company")

Answer

Create an assigned (static) security group and use a scheduled PowerShell script to add compliant Windows devices each night

Answer

Create a dynamic user group with the rule (user.deviceOSType -eq "Windows") so device membership follows the signed-in user

Answer

Create a dynamic device group with the rule (device.displayName -contains "WIN") to capture all Windows machines by naming convention