Search the Community

Using Autopilot Group Tags + Dynamic Groups (Intune) Here’s a guide on something I’ve been working on around Intune, Dynamic Groups, and Autopilot. With MDT effectively reaching end of life, I wanted to put something in place that could act as a solid replacement and also set the groundwork for how we use Autopilot going forward. This all started while looking into Group Tags (OrderID) — I discovered the character limit is 2048, which opens things up quite a bit. From there, I started experimenting with more structured tagging and dynamic grouping. Where to set the Group Tag Just to clarify (as this wasn’t obvious at first), Group Tags are set in the Intune portal here: Devices → Windows → Enrollment → Devices Select your device Click Edit Populate the Group Tag field That’s the value the dynamic group queries will pick up and evaluate. The basic idea Instead of manually putting devices into groups, just use the Autopilot Group Tag (OrderID) to store useful info about the device, then build dynamic groups off that. Once it’s set up properly, everything just sorts itself. Tagging devices When importing devices into Autopilot (or after), set a tag like this: dept=SCI|role=Teacher|site=SiteA|building=BlockA|room=LAB1|dtype=LAP|os=WIN It looks a bit heavy at first, but it lets you store everything in one place: department role location device type Dynamic groups You can then create dynamic groups that match against any part of that tag. Example: all teacher devices device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\brole=Teacher\\b") Example: department device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\bdept=SCI\\b") Example: room device.devicePhysicalIds -any (_ -match "^\\[OrderID\\]:.*\\broom=LAB1\\b") What this gives you Once those groups exist, you just assign: apps policies configs …and devices land in the right place automatically when they enrol. No more dragging devices into groups. Slightly less obvious bit (worth doing) While testing, I came across something really useful — if you add the following as an owner of your dynamic group: Intune Autopilot ConfidentialClient …it helps the group behave more like an authoritative source. Why this helps Without it: People can still manually fiddle with group membership Devices can drift away from your tagging logic With it: The group effectively becomes “hands off” Membership stays driven by Autopilot + your tags Devices stay correctly associated, even after things like an Autopilot reset Things to watch Be consistent with your tag format (biggest one) Dynamic queries must match values exactly Regex needs testing before rollout Keep tags readable — easy to overcomplicate Simple vs structured tags You can do this: Staff-Laptop …but you lose flexibility. Structured tags like: dept=SCI|role=Teacher|room=LAB1 give you much more control without needing loads of extra groups. Final thoughts Once it’s set up properly, it’s one of those “why didn’t I do this earlier” things. Devices get: the right apps the right policies the right config …just based on how they’re tagged. It would be great if there was a proper tag generator or database tool for this, as it’d make maintaining consistency much easier. At the moment I’ve just been using a Copilot-built Excel-style lookup, which works but can be a bit slow. ✅ Hopefully this helps someone — happy to share more examples or what I’ve tested if useful 👍

We received two models of HP's from the DFE over the pandemic. The HP 250 G7 we had no problems joining to intune but HP 255 G7 model is failing with the error code 0x800705b4 on the securing your hardware stage. I understand this can point to an error with the TPM chip but the model does have a TPM 2.0 chip.I have created a blank autopilot profile that is assigned no compliance or config profiles but I still get the same error. I have bypassed our firewall/filter to rule out an error with the internet requests being blocked.Any suggestions to get around this would be greatly appreciated!

Hi all, We look after several schools and we're looking at using AutoPilot to deploy machines straight from factory to customer. Does anyone else use AutoPilot? We use DirectAccess which isn't compatible with AutoPilot however we'll be shipping the devices to schools so as they're being set-up on prem they should pick up the DA group policy but wondered if anyone had encountered any problems. As will all things, we've not got much time to test but looking to try it out in Summer and see if we can get it working.

Hi, Any AutoPilot experts out there I can chat with either via email/dm or phone? Many thanks Gareth

I was getting FAILED on registering your device for mobile management (6, "0x80180014") Deleted device in Intune per (https://docs.microsoft.com/en-us/mem/autopilot/known-issues#delete-device-record-in-intune-before-reusing-devices-in-self-deployment-mode-or-pre-provisioning-mode)Reloaded Windows now Autopilot Fails at "0x81039001" on securing your hardware....There is hardly anything on google for 0x81039001... I have Cleared TPM. and Confirm device was deleted from Intune. What else Could Cause this? Device info: Windows 10 TPM 2.0 Self-Deploying Thoughts?

I thought this would be a good place for everyone to share the best guides for AutoPilot Here is mine https://www.arker-tech.com/index.php/microsoft/the-ultimate-guide-to-auto-pilot thanks

Hi All, We have started to deploy Windows 11 using Endpoint. With Windows 10 we were able to use Pre Provisioning for our devices without any issues. Now using Windows 11 we are finding that it completes the app install on the Enrollment Status Page as expected but then instantly reboots the device. This means the Account Setup stage is missed. There is no error code or anything, it simply reboots to the Windows login page. The device however, is not connected to our domain and has not completed the enrollment. Has anyone come across this at all and if so has anyone found a fix?

Microsoft released their "Golden Path for Education" documentation back in December 2024, but I can't see anyone discussing it on EduGeek at all. https://techcommunity.microsoft.com/discussions/o365education/golden-path-for-education---part-1a/4356169 I've read through the many pages and can see how valuable this document can be when starting from fresh. Has anyone tried to retrospectively apply some of their recommendations to an existing tenancy?

Microsoft are hosting some 1/2 day events on Microsoft 365 for IT Pros in Education. It will include information on Microsoft 365 licenses, Intune + Autopilot, Microsoft Teams. I'm interested to know what questions people have about these topics, or what you'd like to see.

In the sphere of Intune device management, effectively and seamlessly deploying logon scripts has always been a challenge, until now. I'm thrilled to unveil a pioneering solution that is the first of its kind: an Intune package designed to deploy logon scripts through local group policy encapsulated within a Win32 app. This innovative approach combines the robust management capabilities of Intune with the flexibility of local group policies, offering an unprecedented level of control and customisation. Key Features of My Intune Package: Seamless Integration: Utilising local group policy within a Win32 app, this package ensures smooth and efficient deployment of logon scripts across Intune-managed devices. User Experience: Designed to be transparent to the end-user, scripts execute silently in the background, enhancing productivity without any interruptions. Customisation and Control: Tailor desktop settings, UI preferences, and system configurations with precision. From managing shortcuts and setting dark mode to optimising system performance, this package offers extensive customisation capabilities. Security and Compliance: Concluding with the setting of PowerShell execution policies to 'Restricted', this solution enhances device security, safeguarding against unauthorised script executions and potential vulnerabilities. This ground-breaking solution is the result of extensive research, development, and testing, aimed at bridging a significant gap in Intune device management. By leveraging this package, IT administrators can now enjoy a level of script deployment functionality that was previously unattainable, streamlining device setup and configuration processes, and ensuring a consistent user environment across all devices. I am proud to offer this package for download, inviting IT professionals and Intune administrators to revolutionise their device management approach. Embrace the future of Intune management with our innovative solution, and elevate your organisational device management strategy to new heights. Download: https://github.com/cdwyer-240395/Intune-Scripts-Packages Disclaimer: The information provided in this document, including the Intune package for deploying logon scripts through local group policy, is offered "as is" without any warranties or representations, express or implied. While we have made every effort to ensure the accuracy and completeness of the information contained herein, we do not guarantee that the package will function as intended in every environment or configuration. Users should exercise caution and conduct thorough testing in a controlled environment before deploying the package in a production environment. We accept no liability for any damage or loss, including but not limited to data loss, financial loss, or interruption of business activities, arising directly or indirectly from the use of this package. It is the responsibility of the user to comply with all applicable laws and regulations, including those relating to software licensing, data protection, and privacy. The use of this package may require modifications to system settings or configurations that could affect device performance or user experience. Users should ensure they have the necessary technical expertise and permissions to make such changes. By downloading or using this package, you acknowledge that you have read and understood this disclaimer, and you agree to be bound by its terms.

Hi All, Been slowly moving our on prem to the cloud (got app and polices running though Intune, windows updates over Easter), and we are currently co-managed using sccm. Once i have completed these, that only thing i think i will be using SCCM for is OS deployment. I want to start to use autopilot to provision devices instead of SCCM and move away from co-management, but I'm getting super confused on where to start and set this up. I've tried ready various articles and scrolling though the forum here, but not really finding the answers that i want (or at least not or a educational setting with devices used by more than one user). I know how to get the hardware ID from devices and import into Intune - I've already done that for my test device - and i believe the best way to reinstall windows is through a USB version of the OS, but it's the deployment profile that I am getting confused with. Do I need user-driven or self-deploying? I think user-driven is for 1:1 laptops, and self-deploying is for shared devices? or are they the same thing, just not as automated? if it's a shared device, do i need to do anything special once it is all deployed? I.e. I know intune deploys a primary user, so does this need to be removed, and if it does, is there an automated way of doing it?) Do i need a 'deployment' account to sign into the machine for the first time to complete the setup? All devices will go to IT first to be configured before going out to users/classrooms. Can I still access my on prem network if a device is entra connected? Ideally I want to move away from hybrid approach so I can manage everything in the cloud and manage devices regardless of where they physically are, but I'll still need to access some on-prem services like SIMS and a few legacy group policies that i haven't managed to migrate to intune yet, so this is a requirement. I assume if this is the case, then it needs to be set up as a hybrid device, rather than entra joined. sorry for all the questions and if this is basic - I'm just starting to confuse myself (and possibly taking something that is very simple and making it very confusing) and hopefully get some guidance before I start to test this after the Easter holidays. Thanks in advance.