Use Microsoft Endpoint Manager filters to target apps and policies to specific devices

Published 05-12-2021 09:00 AM 16.3K Views
Microsoft

IT administrators can now use filters in Microsoft Endpoint Manager to target apps, policies and other workload types to specific devices. Available in public preview with the May release of Microsoft Intune, the filters feature gives IT admins more flexibility and  helps them protect data within applications, simplify app deployments, and speed up software updates.

 

Microsoft built filters with a consistent and familiar rule authoring experience for admins who use Azure Active Directory dynamic device groups or are discovering the new filters capability in Conditional Access. With filters, administrators can achieve granular targeting of policies and applications to users on specific devices.

 

For example, this new capability makes it easier for administrators to comply with their organizational policies and compliance requirements by deploying:

 

  • A Windows 10 device restriction policy to just the corporate devices of users in the Marketing department while excluding personal devices
  • An iOS app to only the iPad devices for users in the Finance group
  • An Android compliance policy for mobile phones to all users in the company but exclude Android-based meeting room devices that don’t support the settings in that mobile phone policy

 

Filters work in conjunction with Azure AD group assignments or the “All users” or “All devices” groups to dynamically filter the assignment to only apply to a subset of devices during check-in. Dynamic filtering means that devices can be targeted with the right security policy and applications faster than ever before.

 

Filters are re-usable objects that can be applied to many workload types across the Endpoint Manager admin center. IT administrators can create a filter object using expressions across a set of supported device properties and then apply to that filter with an app or policy assignment. When devices check in to receive the policy, the filter evaluation engine determines applicability – either applying or not applying the policy based on the filter result. Results are reported back to the Endpoint Manager admin center so administrators can track policy and app deployment.

 

Workflow:

Microsoft Endpoint Manager filters workflow.png

 

 

Microsoft Endpoint Manager admin center Create Filter (preview).png

 

 

Microsoft Endpoint Manager admin center Android compliance policy.png

 

 

Microsoft Endpoint Manager admin center Android compliance policy filter evaluation.png 

 

Filters is being rolled out with full support across platforms (Windows, Android, iOS and macOS) and an initial set of supported workloads and filter properties. Based on customer feedback, we will expand the capabilities across workloads in the coming months.

 

We value the input we received from customers in private preview. Here are a few highlights:

 

"We are starting to use filters a lot more. We are really looking forward to the previews coming up." 

 

 “The Endpoint Manager filters feature has solved the challenges we faced with managing user-targeted settings and apps for users who have access to both a laptop and virtual desktop. For example, we can now apply a filter to prevent a user-assigned VPN profile from being applied when a user signs into their virtual desktop”

 

"Since we support a large number of different use cases, it’s always difficult to find a seamless way to target your workloads to ensure everyone in the field gets exactly what they need (configurations, apps, certificates, profiles). This is exactly where the Filters feature play a key role to accomplish difficult targeting scenarios. Filters helped us achieve complex assignment models eliminating the need of manual assignment work and helping IT stuff save important time to focus on further strategical and technical design key aspects for a truly modern workplace in our organization."

 

"MEM Filters feature is allowing more granularity for assigning our policies as well as applications. Filters helped us adopt MEM even further in our very mixed environment, allowed us creating a better targeted approach. Filters also addressed a specific use case where we had to exclude virtual devices and critical systems from some of our assignments."

 

"At Krones we support a large number of different use cases and it has always been difficult to find a way to target the specific workloads. Besides we have to ensure, that all employees get the tools they need for their work, like configurations, apps, certificates or profiles. This is exactly where the Filters feature plays a key role to accomplish difficult targeting scenarios. Filters helped us achieve complex assignment models eliminating the need of manual assignment work. As a result, our IT staff saved important time and is now able to focus on further strategic and technical design key aspects for a truly modern workplace within our organization." -Roman Kleyn, Head of Workplace Design at Krones AG

 

 

As always, we appreciate your feedback. Please feel free to post your comment here or or tag me on LinkedIn

 

 

To learn more about AAD, go here: https://aka.ms/RSACIdentity2021

 

4 Comments
New Contributor

Great article however, what we notice is if we deploy an app to Windows devices via all users or all devices, the app shows up as waiting to install on iPads.  We tried to use the filter to exclude iPads but that does seem to help the issue.

Regular Visitor

This is good stuff!  Thank you for sharing. 

Occasional Contributor

@Scott Duffey quick question if I may. I am trying to use the filters with 'Wi-Fi import' profiles. In the assignment blade I get the filter option, but the filter picker then does not list any of my filters. Is this a known issue/limitation or am I doing something wrong? Thanks, Jan

Regular Visitor

Do we have the same 'Filters" capabilities on Conditional Access Policies ? Meaning, we can filter it by Device Ownership? 

Here is our "use case" and our current constraint.

- Enforce Outlook as the only app authorized to access Exchange Online (for both corporate and BYOD devices) : Require Approved App 

- Require a Corporate Device to be compliant (but not BYOD devices as we use MAM WE)

On the Conditional Access Policy for the corporate devices, both conditions must be satisfied.

On the Conditional Access Policy for BYOD devices, only the Required Approved App must be satisfied.

 

As conditional access policies are applied to a user or user group, a user cannot both have a corporate enrolled device and a BYOD registered device (MAM W/E). As both policies are applied to the same user, the more restrictive conditional access policy (corporate devices) gets applied not only on the corporate device but on the BYOD device that is not enrolled (MAM WE).

 

On of the filter parameters shown above is "deviceOwnership". Can we use that prevent the corporate device conditional access policy from applying to the non-corporate devices (BYOD)? 

%3CLINGO-SUB%20id%3D%22lingo-sub-2333342%22%20slang%3D%22en-US%22%3EUse%20Microsoft%20Endpoint%20Manager%20filters%20to%20target%20apps%20and%20policies%20to%20specific%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2333342%22%20slang%3D%22en-US%22%3E%3CP%3EIT%20administrators%20can%20now%20use%20filters%20in%20Microsoft%20Endpoint%20Manager%20to%20target%20apps%2C%20policies%20and%20other%20workload%20types%20to%20specific%20devices.%20Available%20in%20public%20preview%20with%20the%20May%20release%20of%20Microsoft%20Intune%2C%20the%20filters%20feature%20gives%20IT%20admins%20more%20flexibility%20and%20%26nbsp%3Bhelps%20them%20protect%20data%20within%20applications%2C%20simplify%20app%20deployments%2C%20and%20speed%20up%20software%20updates.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EMicrosoft%20built%20filters%20with%20a%20consistent%20and%20familiar%20rule%20authoring%20experience%20for%20admins%20who%20use%20Azure%20Active%20Directory%20dynamic%20device%20groups%20or%20are%20discovering%20the%20new%20filters%20capability%20in%20Conditional%20Access.%20With%20filters%2C%20administrators%20can%20achieve%20granular%20targeting%20of%20policies%20and%20applications%20to%20users%20on%20specific%20devices.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFor%20example%2C%20this%20new%20capability%20makes%20it%20easier%20for%20administrators%20to%20comply%20with%20their%20organizational%20policies%20and%20compliance%20requirements%20by%20deploying%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CUL%3E%0A%3CLI%3EA%20Windows%2010%20device%20restriction%20policy%20to%20just%20the%20corporate%20devices%20of%20users%20in%20the%20Marketing%20department%20while%20excluding%20personal%20devices%3C%2FLI%3E%0A%3CLI%3EAn%20iOS%20app%20to%20only%20the%20iPad%20devices%20for%20users%20in%20the%20Finance%20group%3C%2FLI%3E%0A%3CLI%3EAn%20Android%20compliance%20policy%20for%20mobile%20phones%20to%20all%20users%20in%20the%20company%20but%20exclude%20Android-based%20meeting%20room%20devices%20that%20don%E2%80%99t%20support%20the%20settings%20in%20that%20mobile%20phone%20policy%3C%2FLI%3E%0A%3C%2FUL%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFilters%20work%20in%20conjunction%20with%20Azure%20AD%20group%20assignments%20or%20the%20%E2%80%9CAll%20users%E2%80%9D%20or%20%E2%80%9CAll%20devices%E2%80%9D%20groups%20to%20dynamically%20filter%20the%20assignment%20to%20only%20apply%20to%20a%20subset%20of%20devices%20during%20check-in.%20Dynamic%20filtering%20means%20that%20devices%20can%20be%20targeted%20with%20the%20right%20security%20policy%20and%20applications%20faster%20than%20ever%20before.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EFilters%20are%20re-usable%20objects%20that%20can%20be%20applied%20to%20many%20workload%20types%20across%20the%20Endpoint%20Manager%20admin%20center.%20IT%20administrators%20can%20create%20a%20filter%20object%20using%20expressions%20across%20a%20set%20of%20supported%20device%20properties%20and%20then%20apply%20to%20that%20filter%20with%20an%20app%20or%20policy%20assignment.%20When%20devices%20check%20in%20to%20receive%20the%20policy%2C%20the%20filter%20evaluation%20engine%20determines%20applicability%20%E2%80%93%20either%20applying%20or%20not%20applying%20the%20policy%20based%20on%20the%20filter%20result.%20Results%20are%20reported%20back%20to%20the%20Endpoint%20Manager%20admin%20center%20so%20administrators%20can%20track%20policy%20and%20app%20deployment.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3EWorkflow%3A%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Microsoft%20Endpoint%20Manager%20filters%20workflow.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F279928iE6BE2F728FBA7D2D%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Microsoft%20Endpoint%20Manager%20filters%20workflow.png%22%20alt%3D%22Microsoft%20Endpoint%20Manager%20filters%20workflow.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Create%20Filter%20(preview).png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F279662iC87F23F29E896BF7%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Create%20Filter%20(preview).png%22%20alt%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Create%20Filter%20(preview).png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Android%20compliance%20policy.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F279663iBEA07E71062D3910%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Android%20compliance%20policy.png%22%20alt%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Android%20compliance%20policy.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Android%20compliance%20policy%20filter%20evaluation.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F279926i58CCE152E6319F01%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Android%20compliance%20policy%20filter%20evaluation.png%22%20alt%3D%22Microsoft%20Endpoint%20Manager%20admin%20center%20Android%20compliance%20policy%20filter%20evaluation.png%22%20%2F%3E%3C%2FSPAN%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3E%3CSTRONG%3E%26nbsp%3B%3C%2FSTRONG%3E%3C%2FP%3E%0A%3CP%3EFilters%20is%20being%20rolled%20out%20with%20full%20support%20across%20platforms%20(Windows%2C%20Android%2C%20iOS%20and%20macOS)%20and%20an%20initial%20set%20of%20supported%20workloads%20and%20filter%20properties.%20Based%20on%20customer%20feedback%2C%20we%20will%20expand%20the%20capabilities%20across%20workloads%20in%20the%20coming%20months.%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EWe%20value%20the%20input%20we%20received%20from%20customers%20in%20private%20preview.%20Here%20are%20a%20few%20highlights%3A%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%22We%20are%20starting%20to%20use%20filters%20a%20lot%20more.%20We%20are%20really%20looking%20forward%20to%20the%20previews%20coming%20up.%22%3C%2FEM%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%E2%80%9C%3CEM%3EThe%20Endpoint%20Manager%20filters%20feature%20has%20solved%20the%20challenges%20we%20faced%20with%20managing%20user-targeted%20settings%20and%20apps%20for%20users%20who%20have%20access%20to%20both%20a%20laptop%20and%20virtual%20desktop.%20For%20%3C%2FEM%3E%3CEM%3Eexample%2C%20we%20can%20now%20apply%20a%20filter%20to%20prevent%20a%20user-assigned%20VPN%20profile%20from%20being%20applied%20when%20a%20user%20signs%20into%20their%20virtual%20desktop%E2%80%9D%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%22Since%20we%20support%20a%20large%20number%20of%20different%20use%20cases%2C%20it%E2%80%99s%20always%20difficult%20to%20find%20a%20seamless%20way%20to%20target%20your%20workloads%20to%20ensure%20everyone%20in%20the%20field%20gets%20exactly%20what%20they%20need%20(configurations%2C%20apps%2C%20certificates%2C%20profiles).%20This%20is%20exactly%20where%20the%20Filters%20feature%20play%20a%20key%20role%20to%20accomplish%20difficult%20targeting%20scenarios.%20Filters%20helped%20us%20achieve%20complex%20assignment%20models%20eliminating%20the%20need%20of%20manual%20assignment%20work%20and%20helping%20IT%20stuff%20save%20important%20time%20to%20focus%20on%20further%20strategical%20and%20technical%20design%20key%20aspects%20for%20a%20truly%20modern%20workplace%20in%20our%20organization.%22%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%22MEM%20Filters%20feature%20is%20allowing%20more%20granularity%20for%20assigning%20our%20policies%20as%20well%20as%20applications.%20Filters%20helped%20us%20adopt%20MEM%20even%20further%20in%20our%20very%20mixed%20environment%2C%20allowed%20us%20creating%20a%20better%20targeted%20approach.%20Filters%20also%20addressed%20a%20specific%20use%20case%20where%20we%20had%20to%20exclude%20virtual%20devices%20and%20critical%20systems%20from%20some%20of%20our%20assignments.%22%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CEM%3E%22At%26nbsp%3B%3CSPAN%20data-markjs%3D%22true%22%20data-ogac%3D%22%22%20data-ogab%3D%22%22%20data-ogsc%3D%22%22%20data-ogsb%3D%22%22%3EKrones%3C%2FSPAN%3E%26nbsp%3Bwe%20support%20a%20large%20number%20of%20different%20use%20cases%20and%20it%20has%20always%20been%20difficult%20to%20find%20a%20way%20to%20target%20the%20specific%20workloads.%20Besides%20we%20have%20to%20ensure%2C%20that%20all%20employees%20get%20the%20tools%20they%20need%20for%20their%20work%2C%20like%20configurations%2C%20apps%2C%20certificates%20or%20profiles.%20This%20is%20exactly%20where%20the%20Filters%20feature%20plays%20a%20key%20role%20to%20accomplish%20difficult%20targeting%20scenarios.%20Filters%20helped%20us%20achieve%20complex%20assignment%20models%20eliminating%20the%20need%20of%20manual%20assignment%20work.%20As%20a%20result%2C%20our%20IT%20staff%20saved%20important%20time%20and%20is%20now%20able%20to%20focus%20on%20further%20strategic%20and%20technical%20design%20key%20aspects%20for%20a%20truly%20modern%20workplace%20within%20our%20organization.%22%20-%3C%2FEM%3E%3CEM%3ERoman%20Kleyn%2C%26nbsp%3B%3C%2FEM%3E%3CEM%3EHead%20of%20Workplace%20Design%20at%20Krones%20AG%3C%2FEM%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3EAs%20always%2C%20we%20appreciate%20your%20feedback.%20Please%20feel%20free%20to%20post%20your%20comment%20here%20or%26nbsp%3B%3CSPAN%3Eor%20%3CA%20href%3D%22https%3A%2F%2Fwww.linkedin.com%2Fin%2Fscottduf%22%20target%3D%22_self%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Etag%20me%26nbsp%3Bon%20LinkedIn%3C%2FA%3E.%26nbsp%3B%3C%2FSPAN%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3C%2FP%3E%3CDIV%20class%3D%22video-embed-center%20video-embed%22%3E%3CIFRAME%20class%3D%22embedly-embed%22%20src%3D%22https%3A%2F%2Fcdn.embedly.com%2Fwidgets%2Fmedia.html%3Fsrc%3Dhttps%253A%252F%252Fwww.youtube.com%252Fembed%252FAIt6OSmgcuM%26amp%3Bdisplay_name%3DYouTube%26amp%3Burl%3Dhttps%253A%252F%252Fwww.youtube.com%252Fwatch%253Fv%253DAIt6OSmgcuM%26amp%3Bkey%3Db0d40caa4f094c68be7c29880b16f56e%26amp%3Btype%3Dtext%252Fhtml%26amp%3Bschema%3Dyoutube%22%20width%3D%22600%22%20height%3D%22337%22%20scrolling%3D%22no%22%20title%3D%22YouTube%20embed%22%20frameborder%3D%220%22%20allow%3D%22autoplay%3B%20fullscreen%22%20allowfullscreen%3D%22true%22%3E%3C%2FIFRAME%3E%3C%2FDIV%3E%3CP%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3ETo%20learn%20more%20about%20AAD%2C%20go%20here%3A%20%3CA%20href%3D%22https%3A%2F%2Fnam06.safelinks.protection.outlook.com%2F%3Furl%3Dhttps%253A%252F%252Faka.ms%252FRSACIdentity2021%26amp%3Bdata%3D04%257C01%257Cv-kualex%2540microsoft.com%257Cb111b4c9cb7d4118c35b08d914be2a59%257C72f988bf86f141af91ab2d7cd011db47%257C1%257C0%257C637563629256267980%257CUnknown%257CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%253D%257C1000%26amp%3Bsdata%3DpVhEGiqGZTng7xfsVw%252FsfTpgJKYVhbRBcQREYOVtnCo%253D%26amp%3Breserved%3D0%22%20target%3D%22_blank%22%20rel%3D%22noopener%20nofollow%20noreferrer%22%3Ehttps%3A%2F%2Faka.ms%2FRSACIdentity2021%3C%2FA%3E%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-TEASER%20id%3D%22lingo-teaser-2333342%22%20slang%3D%22en-US%22%3E%3CP%3EMicrosoft%20Endpoint%20Manager's%20filters%20feature%20is%20now%20available%20in%20public%20preview%3C%2FP%3E%0A%3CP%3E%26nbsp%3B%3C%2FP%3E%0A%3CP%3E%3CSPAN%20class%3D%22lia-inline-image-display-wrapper%20lia-image-align-inline%22%20image-alt%3D%22Microsoft%20Endpoint%20Manager%20filters%20workflow.png%22%20style%3D%22width%3A%20999px%3B%22%3E%3CIMG%20src%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fimage%2Fserverpage%2Fimage-id%2F279927i492D05A4D034F1B1%2Fimage-size%2Flarge%3Fv%3Dv2%26amp%3Bpx%3D999%22%20role%3D%22button%22%20title%3D%22Microsoft%20Endpoint%20Manager%20filters%20workflow.png%22%20alt%3D%22Microsoft%20Endpoint%20Manager%20filters%20workflow.png%22%20%2F%3E%3C%2FSPAN%3E%3C%2FP%3E%3C%2FLINGO-TEASER%3E%3CLINGO-LABS%20id%3D%22lingo-labs-2333342%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EMicrosoft%20Endpoint%20Manager%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2351502%22%20slang%3D%22en-US%22%3ERe%3A%20Use%20Microsoft%20Endpoint%20Manager%20filters%20to%20target%20apps%20and%20policies%20to%20specific%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2351502%22%20slang%3D%22en-US%22%3E%3CP%3EGreat%20article%20however%2C%20what%20we%20notice%20is%20if%20we%20deploy%20an%20app%20to%20Windows%20devices%20via%20all%20users%20or%20all%20devices%2C%20the%20app%20shows%20up%20as%20waiting%20to%20install%20on%20iPads.%26nbsp%3B%20We%20tried%20to%20use%20the%20filter%20to%20exclude%20iPads%20but%20that%20does%20seem%20to%20help%20the%20issue.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2370996%22%20slang%3D%22en-US%22%3ERe%3A%20Use%20Microsoft%20Endpoint%20Manager%20filters%20to%20target%20apps%20and%20policies%20to%20specific%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2370996%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F116732%22%20target%3D%22_blank%22%3E%40Scott%20Duffey%3C%2FA%3E%26nbsp%3Bquick%20question%20if%20I%20may.%20I%20am%20trying%20to%20use%20the%20filters%20with%20'Wi-Fi%20import'%20profiles.%20In%20the%20assignment%20blade%20I%20get%20the%20filter%20option%2C%20but%20the%20filter%20picker%20then%20does%20not%20list%20any%20of%20my%20filters.%20Is%20this%20a%20known%20issue%2Flimitation%20or%20am%20I%20doing%20something%20wrong%3F%20Thanks%2C%20Jan%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2360942%22%20slang%3D%22en-US%22%3ERe%3A%20Use%20Microsoft%20Endpoint%20Manager%20filters%20to%20target%20apps%20and%20policies%20to%20specific%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2360942%22%20slang%3D%22en-US%22%3E%3CP%3EThis%20is%20good%20stuff!%26nbsp%3B%20Thank%20you%20for%20sharing.%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-2439438%22%20slang%3D%22en-US%22%3ERe%3A%20Use%20Microsoft%20Endpoint%20Manager%20filters%20to%20target%20apps%20and%20policies%20to%20specific%20devices%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-2439438%22%20slang%3D%22en-US%22%3E%3CP%3EDo%20we%20have%20the%20same%20'Filters%22%20capabilities%20on%20Conditional%20Access%20Policies%20%3F%20Meaning%2C%20we%20can%20filter%20it%20by%20Device%20Ownership%3F%26nbsp%3B%3C%2FP%3E%3CP%3EHere%20is%20our%20%22use%20case%22%20and%20our%20current%20constraint.%3C%2FP%3E%3CP%3E-%20Enforce%20Outlook%20as%20the%20only%20app%20authorized%20to%20access%20Exchange%20Online%20(for%20both%20corporate%20and%20BYOD%20devices)%20%3A%20Require%20Approved%20App%26nbsp%3B%3C%2FP%3E%3CP%3E-%20Require%20a%20Corporate%20Device%20to%20be%20compliant%20(but%20not%20BYOD%20devices%20as%20we%20use%20MAM%20WE)%3C%2FP%3E%3CP%3EOn%20the%20Conditional%20Access%20Policy%20for%20the%20corporate%20devices%2C%20both%20conditions%20must%20be%20satisfied.%3C%2FP%3E%3CP%3EOn%20the%20Conditional%20Access%20Policy%20for%20BYOD%20devices%2C%20only%20the%20Required%20Approved%20App%20must%20be%20satisfied.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EAs%20conditional%20access%20policies%20are%20applied%20to%20a%20user%20or%20user%20group%2C%20a%20user%20cannot%20both%20have%20a%20corporate%20enrolled%20device%20and%20a%20BYOD%20registered%20device%20(MAM%20W%2FE).%20As%20both%20policies%20are%20applied%20to%20the%20same%20user%2C%20the%20more%20restrictive%20conditional%20access%20policy%20(corporate%20devices)%20gets%20applied%20not%20only%20on%20the%20corporate%20device%20but%20on%20the%20BYOD%20device%20that%20is%20not%20enrolled%20(MAM%20WE).%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EOn%20of%20the%20filter%20parameters%20shown%20above%20is%20%22deviceOwnership%22.%20Can%20we%20use%20that%20prevent%20the%20corporate%20device%20conditional%20access%20policy%20from%20applying%20to%20the%20non-corporate%20devices%20(BYOD)%3F%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E
Co-Authors
Version history
Last update:
‎May 11 2021 03:51 PM
Updated by: