Sharing a recap of the questions covered during the live Q&A with timestamps: 

Question – Is there a way to just add devices in Intune to a dynamic group? How should an admin think about creating dynamic groups and that interplay between Entra and Intune? – answered at 46:07.

Question – We really struggle maintaining anywhere close to 100% compliant devices amongst the active Windows devices in Intune across our MSP clients. Its been really difficult to confidently turn on compliance-aware CA Policies in Entra as a result. Too many things feel like they can trigger a compliance failure, even small policies conflicts triggered unexpectedly or a device update could cause a Bitlocker noncompliant device, for instance ... so how to move a little closer to 100% or at least 99% in terms of compliant devices? – answered at 49:09.

Question – You say, don't use "All Devices" or "All Users" - what are the issues with exclusions if we do use them? More importantly, what do you suggest instead if we wish to target all the devices, do you recommend a Dynamic Device Group that includes all Windows Devices excluding personal devices? – answered at 54:18.