intune Intune Dynamic Groups & Autopilot Group Tagging Guide

[JunkyRD]

Using Autopilot Group Tags + Dynamic Groups (Intune)

Here’s a guide on something I’ve been working on around Intune, Dynamic Groups, and Autopilot.

With MDT effectively reaching end of life, I wanted to put something in place that could act as a solid replacement and also set the groundwork for how we use Autopilot going forward.

This all started while looking into Group Tags (OrderID) — I discovered the character limit is 2048, which opens things up quite a bit. From there, I started experimenting with more structured tagging and dynamic grouping.

---

Where to set the Group Tag

Just to clarify (as this wasn’t obvious at first), Group Tags are set in the Intune portal here:

• Devices → Windows → Enrollment → Devices
• Select your device
• Click Edit
• Populate the Group Tag field

That’s the value the dynamic group queries will pick up and evaluate.

---

The basic idea

Instead of manually putting devices into groups, just use the Autopilot Group Tag (OrderID) to store useful info about the device, then build dynamic groups off that.

Once it’s set up properly, everything just sorts itself.

---

Tagging devices

When importing devices into Autopilot (or after), set a tag like this:

dept=SCI|role=Teacher|site=SiteA|building=BlockA|room=LAB1|dtype=LAP|os=WIN

It looks a bit heavy at first, but it lets you store everything in one place:

• department
• role
• location
• device type

---

Dynamic groups

You can then create dynamic groups that match against any part of that tag.

Example: all teacher devices

device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\brole=Teacher\\b")

---

Example: department

device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\bdept=SCI\\b")

---

Example: room

device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\broom=LAB1\\b")

---

What this gives you

Once those groups exist, you just assign:

• apps
• policies
• configs

…and devices land in the right place automatically when they enrol.

No more dragging devices into groups.

---

Slightly less obvious bit (worth doing)

While testing, I came across something really useful — if you add the following as an owner of your dynamic group:

Intune Autopilot ConfidentialClient

…it helps the group behave more like an authoritative source.

Why this helps

Without it:

• People can still manually fiddle with group membership
• Devices can drift away from your tagging logic

With it:

• The group effectively becomes “hands off”
• Membership stays driven by Autopilot + your tags
• Devices stay correctly associated, even after things like an Autopilot reset

---

Things to watch

• Be consistent with your tag format (biggest one)
• Dynamic queries must match values exactly
• Regex needs testing before rollout
• Keep tags readable — easy to overcomplicate

---

Simple vs structured tags

You can do this:

Staff-Laptop

…but you lose flexibility.

Structured tags like:

dept=SCI|role=Teacher|room=LAB1

give you much more control without needing loads of extra groups.

---

Final thoughts

Once it’s set up properly, it’s one of those “why didn’t I do this earlier” things.

Devices get:

• the right apps
• the right policies
• the right config

…just based on how they’re tagged.

---

It would be great if there was a proper tag generator or database tool for this, as it’d make maintaining consistency much easier. At the moment I’ve just been using a Copilot-built Excel-style lookup, which works but can be a bit slow.

---

✅ Hopefully this helps someone — happy to share more examples or what I’ve tested if useful 👍

Edited June 9 by JunkyRD
Forgot to add the part about where to add the group tag.

[Sibrows]

What’s your naming convention for the groups?

[TechMonkey]

It doesn't cover as many options as your Group Tag but don't forget there is the Device Category option.

Edited June 10 by TechMonkey

[JunkyRD]

9 hours ago, Sibrows said:

What’s your naming convention for the groups?

I use SEC_DYN_DEV_WIN_(Site)_(Role)_(Dept) Security, Dynamic, Device, Windows

 

6 hours ago, TechMonkey said:

It doesn't cover as many options as your Group Tag but don't forget there is the Device Category option.

Yes, your right i can use Scope Tags and the Device Categories but this keeps it under enrollment which only the admins can see. 

 

It becomes much easier when reimaging computers, as even if a device is renamed, it remains in the groups assigned through its tag, since these are linked to the device’s serial number.

The grouping process made sense to me because it allows everything to be associated with those tags, meaning the configuration follows the device regardless of its name.

As you know, Intune can be managed either on a user-based or device-based approach. In our case, as a school environment where many machines are shared, it made more sense to adopt a device-based approach.

[Dipl0]

I'm keen to know if anyone has tried to make an intune dynamic group for all devices of a certain year group? So for all Year 7 pupils and their devices to have a group so I could assign specific software to them.

 

I'm struggling to find anything I can do beyond manually assigning them to groups...

[TechMonkey]

I don't know of any way to make a group of devices of a group of users, unless you code it and run it regularly. It would be a useful thing to have, though if you are 1:1 you could just dynamically group the pupils and apply to that.

[JunkyRD]

1 hour ago, Dipl0 said:

I'm keen to know if anyone has tried to make an intune dynamic group for all devices of a certain year group? So for all Year 7 pupils and their devices to have a group so I could assign specific software to them.

 

I'm struggling to find anything I can do beyond manually assigning them to groups...

There isn’t a way to achieve that, unfortunately. Even if you grouped users and devices into the same group, the devices would install the software, and users would also get it installed on any machine they log into.

I do understand what you’re aiming for though — it would be ideal if you could simply say “install this software on these devices, but only for these users.”

What you’re thinking of is closer to how MSIX works, which I looked into when I first started working with Intune.

 

[Dipl0]

1 minute ago, JunkyRD said:

 

There isn’t a way to achieve that, unfortunately. Even if you grouped users and devices into the same group, the devices would install the software, and users would also get it installed on any machine they log into.

I do understand what you’re aiming for though — it would be ideal if you could simply say “install this software on these devices, but only for these users.”

What you’re thinking of is closer to how MSIX works, which I looked into when I first started working with Intune.

 

I worried this may be the case, we have certain tools that aren't on all students devices but only the lower years for example which is what I was trying to achieve. Such a shame as it seems so obvious! Tags seems to be a way to do this but still involves an incredibly manual process of actually mapping devices to the tag to then tag to a group. Might just have to be like that...