Skip to main content

Azure Active Directory Dynamic Groups for AutoPilot and Group Tags

 

Introduction:
In Azure Active Directory (Azure AD), you can create dynamic membership rules to automatically update groups. To quote Microsoft "Dynamic group membership reduces the administrative overhead of adding and removing users".. Or devices. This blog is to detail the properties and syntax needed to create dynamic membership rules for AutoPilot devices and assign deployment and ESP profiles. 

https://docs.microsoft.com/en-us/azure/active-directory/enterprise-users/groups-dynamic-membership 

I wanted to create a group of all AutoPilot registered devices that has a specific Group tag 'PAW'. The intention being to assign a specific AutoPilot deployment profile/ESP and a set of configuration but only to defined computers and not all AutoPilot registered devices. 
Group tags will be created for different departments so they receive specific policy, apps, config per department i.e. Finance, HR, IT services etc.

Within my list of AutoPilot devices (see how to populate AutoPilot list) I clicked on a device and gave it the group tag 'PAW'.


Within Graph Explorer this Group Tag name can be found within the 'PhsicalIds' properties and will form the basis of our dynamic query.

https://graph.microsoft.com/beta/devices/deviceid_1234#######################




Now I need to create a Azure AD Group that only includes AutoPilot registered devices with the PAW group tag.

How to create an Azure AD Group?

Within Azure/Endpoint Manager select groups > New Group.
Enter a Group names
Ensure Dynamic Device is selected within the drop down
Select 'Add dynamic query' to input query syntax





The following query is well documented to populate a group with all AutoPilot registered devices.

(device.devicePhysicalIDs -any _ -contains "[ZTDId]")

By using the 'and' operator we are now adding an additional parameter that must be found within Azure AD to be listed in the group.

As seen within Graph Explorer the OrderID propery now details 'PAW' which can be discovered with the following query.

(device.devicePhysicalIDs -any _ -contains "[ZTDId]") and (device.devicePhysicalIds -any _ -eq "[OrderID]:PAW")







Comments

Post a Comment

Popular posts from this blog

Windows 7 Offline files will not go Online when connected to network

Issue Several laptop users move between networks, domain, home, etc and when they attempt to access DFS shares explorer status is working offline.  The issue only resolves it self after a reboot. Connecting directly to the share works and i am able to ping network resources.  This behavior occurs for VPN users as well. Possible Causes "slow-link mode". In win7 (with default settings) a client will enter slow-link mode if the latency to the server is above 80ms. In slow-link mode all writes are made to the local cache and a background sync only happens every 6 hours.  Depending on your connection the default slow link detection speed is 64,000 bps On client computers running Windows 7 or Windows Server 2008 R2, a shared folder automatically transitions to the slow-link mode if the round-trip latency of the network is greater than 80 milliseconds, or as configured by the "Configure slow-link mode" policy. After transitioning a folder to the slow-link mode, Offline Fil
8 comments
Read more

SCCM Unknown computer not able to see Task Sequences after installing Current Branch 1702

Soon after installing SCCM CB 1702 we were unable to see Task Sequences deployed to the unknown collection. This issue was identified as a random system taking the GUID of the 'x64 Unknown Computer (x64 Unknown Computer)' record. As a result it was now a known GUID; as we were only deploying Task Sequences to the Unknown collection none were made available. 'x64 Unknown Computer (x64 Unknown Computer)' record 'x86 Unknown Computer (x86 Unknown Computer)' record To get the GUID of your unknown systems open SQL management studio and run the following command: --Sql Command to list the name and GUID for UnknownSystems record data select ItemKey, Name0,SMS_Unique_Identifier0 from UnknownSystem_DISC Using the returned GUID (SMS_Unique_Identifier0) we can find the hostname that has been assigned the 'x64 Unknown Computer (x64 Unknown Computer)' GUID by running the query below. --x64 Unknown Computers select Name0,SMS_Unique_Identifier0,Decommissioned0 from Sys
32 comments
Read more

SCCM Client Certificate (PKI) Value is None

SCCM Client Certificate (PKI) Value is None Stopping WMI service Stopping CCMExec SC Delete any sccm services (ccmexec, smstsmgr, cmecservice, ccmsetup) Delete C:\windows\ccm, C:\windows\ccmsetup, C:\windows\ccmcache, C:\Windows\SMSCFG.ini Go into regedit and remove: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCM HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\CCMSetup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SMS Then restart WMI, and reinstall the client. You shouldn't need a reboot to complete this. Once this has been done the client will install and pick up the cert. https://www.windows-noob.com/forums/topic/12644-sccm-2012-client-certificate-pki-value-is-none/
Post a Comment
Read more