Is there a way to scope policies to just Azure VMs? There doesn't appear to be a way in Intune to create a dynamic group that only picks up Azure VMs for when we have policies that we only want to apply to Azure VMs and none of our physical systems.