Azure AD group for Autopilot devices except specific group tag

A very short post to share here based on something I was asked recently. The query below will present you ALL devices which ARE registered for Windows Autopilot, but excluding ones with a specific group tag. I’m sharing this one as it’s not quite as obvious as you may immediately think and it might save someone 30 mins clicking, testing and head scratching.

For example, I want to see all my Autopilot devices but excluding my VIP users who are group tagged as VIP.

(device.devicePhysicalIDs -any (_ -contains "[ZTDId]")) -and -not (device.devicePhysicalIDs -any (_ -eq "[OrderID]:VIP"))

Don’t forget to include all the brackets and quotes. This will not be displayed in the rule builder as the combination of conditions being used is not possible in the UI.

DON’T FORGET to use the Validate Rules feature to make a quick check against some sample device records that you know do and do not meet your requirements. In the example below I used the word “whiteglove” as my group tag, you should switch it for whatever you want to exclude.

Hopefully that saves someone a little bit of time.


5 thoughts on “Azure AD group for Autopilot devices except specific group tag

  1. Definitely saved me time thanks. I have a number of personal devices registered in a customers Autopilot which I need to remove before the engagement concludes.

    Liked by 1 person

    • Sorry for the delayed response. I’m not aware of tracking within the device record attributes to show completed. Potentially using a valid domain join could work or even amend a group tag during your provisioning.


  2. Pingback: Intune RBAC Roles for Multi-Region IT Departments Explained

Leave a Reply to David Williams Cancel reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.