I created a dynamic membership rule
(device.deviceOSType -contains "Windows") -And (device.deviceOwnership -contains "Company") -and (device.accountEnabled -eq true)
The members included all of the deleted windows devices as well. The deleted devices don't show up in Intune, so don't know where they are being pulled from. Is there a way to not include these?
Also when I use the group to install an app, Install Status reports that the deleted device installed the app. These deleted devices have been deleted from Intune and then rejoined.