Skip to main content

001: Filters

Implementation Effort: Low to Medium – Creating filters is straightforward, but good filter design requires clear targeting rules and testing.

User Impact: Low – Users are affected only indirectly through which policies, apps, or protections reach their devices or managed apps.

Overview​

Filters in Microsoft Intune let you narrow an assignment after you target a user or device group. They are especially useful when you want one assignment model but need to include or exclude devices based on platform, ownership, manufacturer, management state, or other supported properties. In Zero Trust, filters help you apply the right control to the right device population without proliferating unnecessary groups, which reduces administrative error and speeds policy tuning.

Implementation Guidance​

  1. Use Microsoft Entra groups for broad entitlement boundaries and use Intune filters for the last-mile targeting decision. A common pattern is one user group plus multiple filters for platform or ownership differences.
  2. Prefer filters when the distinction is attribute-based and dynamic, such as corporate-owned versus personal, iOS versus Android, or specific device manufacturers.
  3. Keep filter rules readable and documented. If a filter becomes too complex to explain in one or two sentences, simplify the assignment design.
  4. Test include and exclude behavior with pilot devices before using the filter on security-sensitive workloads such as compliance, VPN, or app protection related settings.
  5. Review filter dependencies when device inventory attributes change. Enrollment method, ownership, and manufacturer normalization all affect results.
  6. Avoid using filters as a substitute for governance. Filters narrow targeting; they do not replace ownership, change control, or RBAC.

Reference​