You say, don't use "All Devices" or "All Users" - what are the issues with exclusions if we do use them? More importantly, what do you suggest instead if we wish to target all the devices, do you recommend a Dynamic Device Group that includes all Windows Devices excluding personal devices?