How to Create an Azure AD Device Group for Windows 11 Devices

Let’s learn to create Windows 11 Azure AD Device Group. You will have to get ready with Windows 11 PCs sooner than later. One of the things you can start with is creating Azure AD dynamic devices for Windows 11 PCs.

You can create Azure AD dynamic device groups based on available device properties. Well, you can’t create dynamic device groups based on applications installed device (unlike SCCM collections). This is expected because Azure AD is not a device management solution like Intune and SCCM.

The Intune assignment filters are another useful method to filter devices based on their properties. I think Intune filter rules will be powerful as SCCM collection queries in the future. I’ve shared details on using filter rules to include or exclude Windows 11 devices from an app or policy deployment.

Useful Device Properties in Azure AD

There is a bunch of device properties supported in Azure AD. However, I don’t think all the Azure AD device properties are exposed to the public. Let’s first check what the useful device properties in Azure AD from a device management perspective are.

Create Windows 11 Azure AD Device Group - AAD Dynamic Device Group
Create Windows 11 Azure AD Device Group – AAD Dynamic Device Group
AAD Device PropertiesWhat?
Account EnabledNever Used it
Object IDNever Used it
Display NameUseful
Is RootedNot for Windows
Device OS TypeUseful
Device OS Version Useful
Device CategoryNever Used it
Device ManufacturerUseful
Device ModelUseful
Device OwnershipUseful
Enrollment Profile NameUseful
Management TypeNever Used it
OU DetailsNever Used it
Device IDNever Used it
Device Physical IDsNever Used it
System LabelUseful

Create Windows 11 Azure AD Device Group – AAD Dynamic Device Group

Create Azure AD Dynamic Device Group for Windows 11

Let’s now build an Azure AD dynamic device group for Windows 11 PCs. I think the best reliable option is to go with OS version properties. However, if you plan to onboard Hololens and another kind of Windows 11 device into Azure AD/MEM management, you should use additional properties as well.

  • Open portal.azure.com
  • Navigate to Azure AD (Azure Active Directory) -> Groups – All Groups.
  • Click on “+ New Group“.
  • Select Security – Group Type from the drop-down option.
  • Enter Group Name “Windows 11 Devices” (any name is fine).
  • Enter Group Description “Group for Windows 11 Devices” (any description is fine).
  • Select Dynamic Device as Membership type.
  • Click on Add Dynamic Query under Dynamic Device Members.
Create Windows 11 Azure AD Device Group - AAD Dynamic Device Group
Create Windows 11 Azure AD Device Group – AAD Dynamic Device Group

Hover over the properties column so that you get an option to select Azure AD dynamic device groups based on Windows 11 OS Version. Otherwise, you can also copy-paste the following query to create an Azure AD dynamic device for Windows 11 Devices.

  • Property – osVersion
  • Operator – StartsWith
  • Value – 10.0.2
(device.deviceOSVersion -startsWith "10.0.2")
Create Windows 11 Azure AD Device Group - AAD Dynamic Device Group
Create Windows 11 Azure AD Device Group – AAD Dynamic Device Group

NOTE! – I don’t know whether there will be other types of Windows 11 Devices in your production tenants. For Examples, Surface Studio, Devices in meeting rooms, Hololens? You will have to be careful whether these devices will be part of Azure AD Windows 11 Device Group or not.

Validate the Logic of Azure AD Dynamic Query

Always perform the validation of Dynamic queries before putting those into production. There is Validate Rules tab within Dynamic query membership rules. You can use the validate options to confirm whether the AAD dynamic query logic works as you expect or not.

  • Click on Validate Rules
  • Add Devices – Select at least two or three devices. Some of the devices you think should be part of this group and some of them that should not be part of this group.
  • Check the validation results blade to understand and confirm whether your Azure AD dynamic device group query logic is correct or not.

There is an option to validate the dynamic query, and it’s beneficial. Once validation is completed, you can click on SAVE and CREATE buttons to complete the process of building Windows 11 Azure AD dynamic device group creation.

Create Windows 11 Azure AD Device Group - AAD Dynamic Device Group
Create Windows 11 Azure AD Device Group – AAD Dynamic Device Group

Results

You can check the results from the member’s tab of the Windows 11 AAD dynamic group. Normally, the Azure AD dynamic device groups get updated within 5 minutes or so. However, Microsoft doesn’t have any SLA less than 24 hours for the AAD dynamic group auto-update process.

Create Windows 11 Azure AD Device Group 1
Create Windows 11 Azure AD Device Group – AAD Dynamic Device Group

Ref: Cannot sign in to Office 365 Desktop Apps – Microsoft Community