Home
%3CLINGO-SUB%20id%3D%22lingo-sub-815336%22%20slang%3D%22en-US%22%3ESupport%20Tip%3A%20Using%20group%20tags%20to%20import%20devices%20into%20Intune%20with%20Autopilot%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-815336%22%20slang%3D%22en-US%22%3E%3CP%3EHi%20everyone%2C%20today%20we%20have%20a%20post%20co-authored%20by%20Intune%20Support%20Escalation%20Engineer%26nbsp%3B%3CSTRONG%3ESaurabh%20Koshta%3C%2FSTRONG%3E%26nbsp%3Band%20Intune%20Support%20Engineer%20%3CSTRONG%3EMatt%20Gardner%3C%2FSTRONG%3E.%20In%20this%20post%20they%20discuss%20how%20you%20can%20use%20group%20tags%20to%20control%20device%20enrollment%20options%20via%20Windows%20Autopilot.%20This%20is%20a%20really%20handy%20feature%20so%20if%20you%E2%80%99re%20using%20Autopilot%20you%E2%80%99ll%20definitely%20want%20to%20check%20this%20out.%20As%20always%2C%20if%20you%20have%20any%20questions%20you%20can%20post%20them%20in%20the%20comments%20sections%20at%20the%20bottom%20of%20the%20page.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3D%3D%3D%3D%3D%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EIn%20this%20post%2C%20Matt%20and%20I%20are%20%3CSPAN%3Egoing%20to%20discuss%20how%20you%20can%20use%20group%20tags%20to%20group%20devices%20together%2C%20allowing%20you%20to%20then%20specify%20different%20Autopilot%20enrollment%20options%20for%20each%20group%20of%20devices%20with%20the%20same%20group%20tag.%20Note%20that%20this%20is%20just%20one%20example%20of%20how%20you%20can%20use%20group%20tags%20-%20there%20are%20many%20other%20scenarios%20as%20well.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSTRONG%3EThe%20Scenario%3C%2FSTRONG%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3EContoso%20has%20obtained%20100%20Windows%20devices%20that%20will%20be%20used%20by%20Sales%2C%20Marketing%2C%20Finance%20and%20Accounting%20teams.%20Users%20on%20the%20Sales%20team%20will%20not%20have%20their%20devices%20joined%20to%20the%20local%20on-prem%20domain%2C%20and%20the%20users%20will%20need%20to%20be%20local%20administrators.%20Users%20on%20the%20Accounting%20team%20will%20be%20joined%20to%20the%20local%20domain%20and%20will%20%3CU%3Enot%3C%2FU%3Ebe%20local%20administrators%20on%20their%20computers.%26nbsp%3B%3C%2FSPAN%3E%3CSPAN%3E%26nbsp%3BEach%20team%20needs%20to%20have%20their%20own%20Autopilot%20deployment%20profile%20to%20fit%20their%20needs.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3ESo%20how%20do%20we%20achieve%20this%20goal%3F%26nbsp%3BHere%20is%20where%20using%20group%20tags%20can%20really%20help.%20%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%3CSTRONG%3ENOTE%3C%2FSTRONG%3E%3C%2FSPAN%3E%3CSPAN%3E%3CEM%3EThis%20scenario%20assumes%20the%20devices%20were%20obtained%20from%20a%20partner%20that%20provided%20the%20initial%20.csv%20file.%20%3C%2FEM%3E%3C%2FSPAN%3E%3CA%20href%3D%22https%3A%2F%2Fwww.microsoft.com%2Fen-us%2Fmicrosoft-365%2Fwindows%2Fwindows-autopilot%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CSPAN%3E%3CEM%3EHere%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FA%3E%3CSPAN%3E%3CEM%3Eis%20a%20list%20of%20participating%20device%20manufactures.%3C%2FEM%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%3E1.%20We%20start%20by%20modifying%20the%20.csv%20to%20add%20another%20column%20called%20%3CSTRONG%3EGroup%20Tag%3C%2FSTRONG%3E.%20We%20then%20we%20add%20a%20tag%20called%20%3CEM%3ESales%3C%2FEM%3Eto%20the%20group%20of%20devices%20that%20will%20be%20allocated%20to%20the%20Sales%20team%2C%20a%20tag%20called%20%3CEM%3EAccounting%3C%2FEM%3Eto%20the%20group%20of%20devices%20that%20will%20be%20allocated%20to%20the%20Accounting%20team%2C%20etc.%20Here%20is%20an%20example%3A%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20729px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F127835i58B5C07C511F039B%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22jc-SK1b.png%22%20title%3D%22jc-SK1b.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E2.%20The%20next%20step%20is%20to%20upload%20the%20device%20list%20to%20Intune.%20Please%20note%20that%20it%20is%20recommended%20you%20use%20Intune%20portal%20to%20upload%20the%20device%20list%20as%20mentioned%20in%20this%20article%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fenrollment-autopilot%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3E%3CEM%3EEnroll%20Windows%20devices%20in%20Intune%20by%20using%20the%20Windows%20Autopilot%3C%2FEM%3E%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20indicated%20in%20the%20article%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3EIf%20you%20aren't%20interested%20in%20mobile%20device%20management%2C%20you%20can%20use%20Autopilot%20in%20other%20portals.%20%3CSTRONG%3E%3CFONT%20color%3D%22%23800000%22%3EWhile%20using%20other%20portals%20is%20an%20option%2C%20we%20recommend%20you%20only%20use%20Intune%20to%20manage%20your%20Autopilot%20deployments%3C%2FFONT%3E%3C%2FSTRONG%3E.%20When%20you%20use%20Intune%20and%20another%20portal%2C%20Intune%20isn't%20able%20to%3A%3C%2FEM%3E%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3E%3CEM%3EDisplay%20changes%20to%20profiles%20created%20in%20Intune%2C%20but%20edited%20in%20another%20portal%3C%2FEM%3E%3C%2FLI%3E%0A%3CLI%3E%3CEM%3ESynchronize%20profiles%20created%20in%20another%20portal%3C%2FEM%3E%3C%2FLI%3E%0A%3CLI%3E%3CEM%3EDisplay%20changes%20to%20profile%20assignments%20done%20in%20another%20portal%3C%2FEM%3E%3C%2FLI%3E%0A%3CLI%3E%3CEM%3ESynchronize%20profile%20assignments%20done%20in%20another%20portal%3C%2FEM%3E%3C%2FLI%3E%0A%3CLI%3E%3CEM%3EDisplay%20changes%20to%20the%20device%20list%20that%20were%20made%20in%20another%20portal%3C%2FEM%3E%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3EOnce%20the%20.csv%20has%20been%20uploaded%20to%20Intune%2C%20the%20devices%20will%20display%20this%20same%20group%20tag%20information%20as%20shown%20in%20the%20screen%20shot%20below.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F127836iCDF3B63CBB74BDCA%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22jc-SK1.png%22%20title%3D%22jc-SK1.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E3.%20Next%20we%E2%80%99ll%20create%20a%20dynamic%20device%20group%20and%20add%20the%20devices%20into%20their%20respective%20groups.%20Details%20for%20creating%20a%20dynamic%20device%20group%20can%20be%20found%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fazure%2Factive-directory%2Fusers-groups-roles%2Fgroups-create-rule%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E%2C%20and%20the%20query%20for%20the%20groups%20that%20we%E2%80%99ll%20use%20is%20this%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E(device.devicePhysicalIds%20-any%20_%20-eq%20%22%5BOrderID%5D%3ASales%22)%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F127837i52AB794311F768F6%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22jc-SK2.png%22%20title%3D%22jc-SK2.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EOnce%20the%20device%20groups%20are%20created%2C%20we%20can%20view%20each%20one%20and%20see%20the%20members.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F127838i632E49DC014FFE62%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22jc-SK3.png%22%20title%3D%22jc-SK3.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F127840i0CC52CD8AE362A9D%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22jc-SK4.png%22%20title%3D%22jc-SK4.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E4.%20Now%20all%20we%20need%20to%20do%20is%20assign%20deployment%20profiles%20to%20each%20of%20these%20device%20groups.%20We%20won%E2%80%99t%20go%20into%20all%20the%20details%20of%20how%20to%20create%20and%20assign%20Windows%20Autopilot%20deployment%20profiles%20as%20you%20can%20get%20all%20the%20details%20of%20that%20%3CA%20href%3D%22https%3A%2F%2Fdocs.microsoft.com%2Fen-us%2Fintune%2Fenrollment-autopilot%23create-an-autopilot-deployment-profile%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%20noopener%20noreferrer%22%3Ehere%3C%2FA%3E.%20Once%20you%E2%80%99ve%20created%20and%20assigned%20the%20deployment%20profiles%20you%20can%20verify%20the%20profile%20status%20under%20%3CSTRONG%3EDevice%20Enrollment%20%E2%80%93%20Windows%20Enrollment%3C%2FSTRONG%3E-%26gt%3B%20%3CSTRONG%3EWindows%20Autopilot%20Devices%3C%2FSTRONG%3E.%20Here%E2%80%99s%20an%20example%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Fgxcuf89792.i.lithium.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F127841i35F8A5D074E854E1%2Fimage-size%2Flarge%3Fv%3D1.0%26amp%3Bpx%3D999%22%20alt%3D%22jc-SK7.png%22%20title%3D%22jc-SK7.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3EThat%E2%80%99s%20all%20there%20is%20to%20it.%20Now%20when%20these%20devices%20are%20powered%20on%2C%20each%20will%20be%20enrolled%20based%20on%20the%20settings%20of%20their%20assigned%20Autopilot%20deployment%20profiles.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CEM%3ESaurabh%20Koshta%3C%2FEM%3E%3C%2FSTRONG%3E%3CEM%3E%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3EIntune%20Support%20Escalation%20Engineer%26nbsp%3B%7C%20Microsoft%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3E%26nbsp%3B%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CEM%3EMatt%20Gardner%3C%2FEM%3E%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CEM%3ESupport%20Engineer%20%7C%20Microsoft%3C%2FEM%3E%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-815336%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20post%20discussed%20how%20you%20can%20use%20group%20tags%20to%20control%20device%20enrollment%20options%20via%20Windows%20Autopilot.%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-815336%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAutopilot%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3Eenrollment%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EWindows%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-818752%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%3A%20Using%20group%20tags%20to%20import%20devices%20into%20Intune%20with%20Autopilot%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-818752%22%20slang%3D%22en-US%22%3E%3CP%3EHi%2C%20What%20happens%20if%20the%20Dynamic%20group%20rules%20wizard%20in%20your%20tenant%20is%20now%20showing%20the%20new%20version%20with%20the%20Rules%20builder.%26nbsp%3B%20This%20is%20an%20issue%20for%20us%20the%20the%20currently%20published%20rules%20for%20dynamic%20groups%20for%20things%20like%20Order%20tags%20are%20no%20longer%20accepted%20as%20correct%20syntax.%26nbsp%3B%20Especially%20if%20the%20rule%20is%20compounded%20to%20be%20a%20specific%20order%20ID%20and%20a%20HW%20Model%20Type.%3CBR%20%2F%3EDoes%20Microsoft%20plan%20to%20update%20the%20online%20doco%20to%20detail%20the%20new%20syntax%20required%3F%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-841875%22%20slang%3D%22en-US%22%3ERe%3A%20Support%20Tip%3A%20Using%20group%20tags%20to%20import%20devices%20into%20Intune%20with%20Autopilot%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-841875%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20awesome!!%3C%2FP%3E%3C%2FLINGO-BODY%3E
Microsoft

Hi everyone, today we have a post co-authored by Intune Support Escalation Engineer Saurabh Koshta and Intune Support Engineer Matt Gardner. In this post they discuss how you can use group tags to control device enrollment options via Windows Autopilot. This is a really handy feature so if you’re using Autopilot you’ll definitely want to check this out. As always, if you have any questions you can post them in the comments sections at the bottom of the page.

 

=====

 

In this post, Matt and I are going to discuss how you can use group tags to group devices together, allowing you to then specify different Autopilot enrollment options for each group of devices with the same group tag. Note that this is just one example of how you can use group tags - there are many other scenarios as well.

 

The Scenario

Contoso has obtained 100 Windows devices that will be used by Sales, Marketing, Finance and Accounting teams. Users on the Sales team will not have their devices joined to the local on-prem domain, and the users will need to be local administrators. Users on the Accounting team will be joined to the local domain and will not be local administrators on their computers.  Each team needs to have their own Autopilot deployment profile to fit their needs.

 

So how do we achieve this goal? Here is where using group tags can really help.

 

NOTE This scenario assumes the devices were obtained from a partner that provided the initial .csv file. Here is a list of participating device manufactures.

 

1. We start by modifying the .csv to add another column called Group Tag. We then we add a tag called Sales to the group of devices that will be allocated to the Sales team, a tag called Accounting to the group of devices that will be allocated to the Accounting team, etc. Here is an example:

 

jc-SK1b.png

2. The next step is to upload the device list to Intune. Please note that it is recommended you use Intune portal to upload the device list as mentioned in this article:

 

Enroll Windows devices in Intune by using the Windows Autopilot

 

As indicated in the article:

 

If you aren't interested in mobile device management, you can use Autopilot in other portals. While using other portals is an option, we recommend you only use Intune to manage your Autopilot deployments. When you use Intune and another portal, Intune isn't able to:

  • Display changes to profiles created in Intune, but edited in another portal
  • Synchronize profiles created in another portal
  • Display changes to profile assignments done in another portal
  • Synchronize profile assignments done in another portal
  • Display changes to the device list that were made in another portal

Once the .csv has been uploaded to Intune, the devices will display this same group tag information as shown in the screen shot below.

 

jc-SK1.png

3. Next we’ll create a dynamic device group and add the devices into their respective groups. Details for creating a dynamic device group can be found here, and the query for the groups that we’ll use is this:

 

(device.devicePhysicalIds -any _ -eq "[OrderID]:Sales")

 

jc-SK2.png

Once the device groups are created, we can view each one and see the members.

 

jc-SK3.png

jc-SK4.png

 

4. Now all we need to do is assign deployment profiles to each of these device groups. We won’t go into all the details of how to create and assign Windows Autopilot deployment profiles as you can get all the details of that here. Once you’ve created and assigned the deployment profiles you can verify the profile status under Device Enrollment – Windows Enrollment -> Windows Autopilot Devices. Here’s an example:

 

jc-SK7.png

That’s all there is to it. Now when these devices are powered on, each will be enrolled based on the settings of their assigned Autopilot deployment profiles.

 

Saurabh Koshta 

Intune Support Escalation Engineer | Microsoft

 

Matt Gardner

Support Engineer | Microsoft

2 Comments
Senior Member

Hi, What happens if the Dynamic group rules wizard in your tenant is now showing the new version with the Rules builder.  This is an issue for us the the currently published rules for dynamic groups for things like Order tags are no longer accepted as correct syntax.  Especially if the rule is compounded to be a specific order ID and a HW Model Type.
Does Microsoft plan to update the online doco to detail the new syntax required?

Senior Member

This is awesome!!