Updated 02/15/21: We're excited to take the preview tag off and share that filters is now generally available in Microsoft Intune! See: https://aka.ms/MEMFiltersGA to learn more.
Today we released an exciting new feature in Microsoft Intune that we call “Filters”. The feature adds greater flexibility for assigning apps and policies to groups of users or devices. Using filters, you can now combine a group assignment with characteristics of a device to achieve the right targeting outcome. For example, you can use filters to ensure that an assignment to a user group only targets corporate devices and doesn’t touch the personal ones. Read more about the announcement here and review the feature documentation here.
The feature is enabled with the service-side update of the 2105 service release, so you can expect to see it in the Microsoft Endpoint Manager admin center starting May 7 and continuing as the service-side updates.
Here is an overview of the feature: Use Microsoft Endpoint Manager filters to target apps and policies to specific users | YouTube.
The feature is released for Public preview and is supported by Microsoft to use in production environments. The following known issues apply. We will remove items off this list as issues are resolved.
Known issues:
- Available Apps on Android DA enrolled devices: Filter evaluation for available apps requires Company Portal app version 5.0.4868.0 (released to Android Play store August 2020) or higher for filter evaluation. If a device does not have this version (or higher) installed, apps will incorrectly show as available in the Company portal but be blocked from installing on the device.
Known issues for reporting:
- Filter evaluation reports for Available Apps: The “Managed Apps” (Device > [Devicename] > Managed Apps) “Resolved intent” column incorrectly shows a status of “Available for install” of Available apps, even if the device should be excluded by a Filter. To see evaluation results for Available apps you should go to the Filter evaluation page (Device > [Devicename] > Filter evaluation).
- Delay in filter evaluation report data: There is a case where filter evaluation reports (Devices > All Devices > [Devicename]> Filter evaluation) are not updated with the most recent evaluation results. This case only occurs in a special case where a filter is used in an assignment, some evaluation results are produced and then the filter is later removed from that assignment. In this scenario the report may take up to 48 hours to reflect. Note, this occurs only if the filter is removed from the assignment and not if the assignment is recreated by removing the group and then re-adding it without a filter.
- Unexpected policies for other platform types show up in filter evaluation report: The Filter evaluation report for a single device (Devices > All Devices > [DeviceName]> Filter evaluation (preview)) shows all policies and apps that were targeted at the device or primary user of the device for which there was a filter evaluation performed, even if the policy type is not applicable for the platform of the device you are interested in. For example, if you assign a Windows 10 configuration policy to a user (a group that contains the user) along with a filter, you will notice that the filter evaluation report lists of policies for that user’s iOS, Android and macOS devices will also show Windows 10 policies and evaluation results. Note: The evaluation results will always be “Not Match” due to platform.
- No way to see which policies and apps are using a filter: When editing or deleting an existing filter, there is no way in the UX to see where that filter is currently being used. We’re working on adding this (see “Features in development” below). As a workaround, you can use this PowerShell script that will walk through all assignments in your tenant and return the policies and apps where the filter has been used. See Get-AssociatedFilter.ps1 script here.
Features in development:
- Associated assignments – We’re working on an improvement to select a filter and be able to identify all the associated policies and apps where that filter is being used.
- More workloads – We’re adding filters to the assignment pages of more Intune workloads including Endpoint Security, Proactive remediation scripts, Windows update policies and more. Updated 01/11/23 - Support for these features are now fully available in Intune!
Frequently Asked Questions
Do filters replace group assignments?
No. Filters are used on top of groups when you assign apps and policies and give you more granular targeting options. Assignments still require you to target a group and then refine that scope using a filter. In some scenarios, you may wish to target “All users” or “All devices” virtual groups and further refine using filters in include or exclude mode.
What about “Excluded groups”? Can I use a filter on these assignments?
While filters cannot be added on top of an “Excluded group” assignment the desired outcome can be achieved by combining Included groups with filters. Filters provide greater flexibility than Excluded groups because the “excluded groups” feature does not support mixing group types. See: supportability matrix to learn more.
Excluded groups are still a great option for user exception management – For example, you deploy to “All Users” and exclude “VIP Users”.
Now with filters you can build on top of existing capability by mixing user and device targeting. You can, for example define a filter to – Deploy to “All Users”, exclude “VIP Users” and only install on the “Corporate-owned” devices.
Here is summary guidance on how to use Groups, Exclude groups and Filters:
- Filters complement Azure AD groups for scenarios where you want to target a user group but filter ‘in’/’out’ devices from that group. For example: assign a policy to “All Finance Users” but then only apply it on corporate devices.
- Filters provide the ability to target assignments to ‘All Users’ and ‘All Devices’ virtual groups while filtering in/out specific devices. The “All users” groups are not Azure AD groups, but rather Intune “virtual” groups that have improved performance and latency characteristics. For latency-sensitive scenarios admins can use these groups and then further refine targeted devices using filters.
- "Excluded groups" option for Azure AD groups is supported, but you should use it mainly for excluding user groups. When it comes to excluding devices, we recommend using filters because they offer faster evaluation over dynamic device groups.
General recommendations on groups and assignment:
- Think of Include/Exclude groups as an initial starting point for deploying. The AAD group is the limiting group so use the smallest group scope possible.
- Assigned (also known as static) Azure AD groups can be used for Included or Excluded groups, however it usually is not practical to statically assign devices into an AAD group unless they are pre-registered in AAD (eg: via autopilot) or if you want to collect them for a one-off, ad-hoc deployment.
- Dynamic Azure AD user groups can be used for Include/Exclude groups.
- Dynamic AAD device groups can be used for Include groups but there may be latency in populating group membership. In latency-sensitive scenarios where it is critical for targeting to occur instantly upon enrollment, consider using an assignment to User groups and then combine with filters to target the intended set of devices. If the scenario is userless, consider using the “All devices” group assignment in combination with filters.
- Avoid using Dynamic Azure AD device groups for Excluded groups. Latency in dynamic device group calculation at enrollment time can cause undesirable results such as unwanted apps and policy being delivered before the excluded group membership can be populated.
Are Intune Roles (RBAC) and scope tags supported?
Yes. During the filter creation wizard, you can add scope tags to the filter. (Note: The “Scope Tags” wizard screen only shows if your tenant has configured scope tags). There are four new privileges available for filters (Read, Create, Update, Delete). These permissions exist for built-in roles (Policy admin, Intune admin, School admin, App admin). To use a filter when assigning a workload, you must have the right permissions: You must have permission to the filter, permission to the workload and permission to assign to the group you chose.
Is the Audit Logs feature supported?
Yes. Any action performed by an admin on assignment filter objects is recorded in audit logs (Tenant administration -> Audit logs). This also includes the action of enabling the Filters feature in your account.
Can I use filters with user group assignments?
Yes. This is a good scenario for using filters. For example, you can assign a policy to “All finance users” and then apply an assignment filter to only include “Surface Laptop” devices.
Can I create a filter based on any device property I can see in Intune?
No, not yet but we plan to add more filter properties over time. The list of supported properties is here. Please let us know about the properties that would help in your scenarios to: aka.ms/MEMfiltersfeedback.
Can I use filters in any assignment in Intune?
While in preview, filters are available to use in a core set of workload types (Apps, Compliance and Configuration profiles). The list of supported properties is here. Please let us know about the properties that would help in your scenarios at aka.ms/MEMFiltersfeedback.
How does assignment filtering get reflected in device status and device install status reports in the Microsoft Endpoint Manager admin center?
Filter reporting information exists for each device under a new stand-alone report area called “Filter evaluation” and we’re working to further integrate reporting information into existing reports such as the “Device status” and “Device install” reports. As an example of where this is going, the apps report has a new column called “Filter (preview)” under Device install status. Over time you will see further integration of the filter information into other workload type reports.
If you deploy a policy (Compliance or Configuration) to a group and navigate to the “Device status” report, there is a row in the report for each targeted device. When each targeted device checks-in the device will be evaluated against the associated filter and this status will be updated (For example, the status will show “Not Applicable” if the assignment filter filtered the policy out). For apps, the experience (in the Device install status report) is similar, except that you can view details on the filter evaluation by clicking on the “Filters evaluated” link.
Example of filter evaluation under the Device install status report
How many filters can I create?
There is a limit of 200 filters per customer tenant.
How many expressions can I have in a filter?
There is a limit of 3072 characters per filter.
Can I use more than one filter in an assignment?
No. An assignment includes the combination of Group + Filter + Other deployment settings. While you can’t use more that one filter per assignment you can certainly use more than one assignment per policy or app. For example, you can deploy an iOS device restriction policy to “Finance users” and “HR users” groups and have a different assignment filter linked to each of those assignments. However, be careful not to create overlaps or conflicts. We don’t recommend it but have documented the behavior here.
How do Filters work with the Windows 10 “Applicability Rules” feature?
Filters are a super-set of functionality from “Applicability rules” and as such we recommend that you use filters instead. We do not recommend combining the two together or know of a reason to, but if you do have a policy assigned with both, the expected result is that both will apply. The filter will be processed first, then a second iteration of applicability will be undertaken by the applicability rules feature.
Documentation
- Use Microsoft Endpoint Manager filters to target apps and policies to specific devices
- Use Microsoft Endpoint Manager filters to target apps and policies to specific users | YouTube
- Create filters in Microsoft Intune
- Supported filter device properties and operators in Microsoft Intune
- Platforms and policy types supported by filters in Microsoft Intune
- Filter reports and troubleshooting in Microsoft Endpoint Manager
- Public preview overview in Microsoft Intune
Let us know if you have any questions by replying to this post or reaching out to @IntuneSuppTeam on Twitter.
Post updates:
6/14/21: Updated with a known issue for reporting. “Pending” deployment status result and “Not evaluated” compliance status result in Android Enterprise policy reports.
6/29/21: Previous known issue: Compliance policy for “Risk score” and “Threat Level” is now resolved and is available in the June (2106) service release! More info can be found in our What's new docs here: Use filters on Settings Catalog configuration profiles, and Risk Score and Threat Level compliance policy settings.
7/29/21: Previous known issue: OSversion property for macOS devices is now resolved in the July (2107) service release.
8/24/21: Previous known issue: Win32 apps reporting is now resolved in the August (2108) service release.
12/1/21: Previous known issue: "Pending” deployment status result and “Not evaluated” compliance status result in Android Enterprise policy reports is now resolved in the November (2111) service release.
02/15/21: Filters is now generally available in Microsoft Endpoint Manager! See: https://aka.ms/MEMFiltersGA to learn more.
02/06/23: Previous in-development feature Pre-deployment reporting is now available via Preview devices.
Microsoft
