Divide iOS devices for Compliance

nhtkid 

I don't think there's a query filter that will provide information on what devices "support upgrade" to iOS 16. It can only look at if the device is already on that version or not.

You can still keep your Compliance Policy global at 15.7 as the minimum supported version, which would block all lesser versions but allow those above on 16. There isn't often a need to have different compliance polices by version, so it may be simpler to just settle on the least common denominator.

The only other way to separate them is to put the "old" iOS devices into a static collection and "exclude" that group from the "newer version" compliance policy (and vice versa). But you'd still have to determine some distinguishing characteristic to identify the devices unable to upgrade and manually put them into the static collection. The Model attribute seems to be the only viable way to do it with dynamic device groups.

But there is the Product Name information under Hardware in Intune, which breaks it down in a bit further granularity per https://gist.github.com/adamawolf/3048717. Perhaps the Azure AD PowerShell module or Graph API could be used to pull that info and add the device to a static collection as a workaround.

Please like or mark this thread as answered if it's helpful, thanks!