Serial number for dynamic group membership

Hi jjrodgers ,

It is not possible to use serialnumber for a dynamic rule, see the below possible properties.

As defined in the Microsoft documentation: 
Rules for dynamically populated groups membership - Azure AD | Microsoft Docs

But what i understand from your question is that you want to install the Microsoft Authenticator app without sign into the company portal, and you want to test this first on a test device. 

Good news, It is possible, but how? 

1. Purchase the authenticator app via Apple Business Manager (device license), but that is default  
Manage Apple volume-purchased apps - Microsoft Intune | Microsoft Docs

2. Sync app to the intune portal

3. Create a new DEP Profile (with different name but same settings) in the Intune portal and assign your test device to that profile. 

4. Create a dynamic group with the following rule syntax (device.enrollmentProfileName -eq "New DEP Profile")

5. Assign the new dynamic device group as required to the Microsoft Authenticator app

6. App will be installed on a device without login to the company portal. 

I hope this helps you with installing the Authenticator app without logon to the company portal.

If this fixed your problem. Please let me know and mark this as a solution.

Kind regards,

Rene