跳到主要内容

002: Device groups

Implementation Effort: Low to Medium – Group creation is easy, but governance and lifecycle management take planning.

User Impact: Low – Device groups change how settings and apps are targeted more than how users interact with devices.

Overview​

Device groups in Microsoft Entra ID are commonly used by Microsoft Intune to target configurations that should follow the device rather than the user. Examples include kiosk settings, hardware-specific configurations, Windows update rings for a hardware cohort, or baseline controls for shared devices. In Zero Trust, well-designed device groups improve precision and reduce accidental over-targeting, but they should be used intentionally so the environment does not become hard to understand or maintain.

Implementation Guidance​

  1. Use device groups when the policy intent is tied to the endpoint itself, such as device restrictions, update policies, hardware-specific apps, shared device mode, or a staging ring for remediation.
  2. Prefer user groups for user-centric experiences such as Microsoft 365 app entitlements, app protection targeting, or settings that should follow the person across devices.
  3. Use dynamic membership where stable device attributes exist and the rule is easy to validate. For exceptions or small pilots, manual groups may be safer and simpler.
  4. Standardize naming so engineers can tell whether a group is for enrollment, deployment, administration, exclusion, or reporting. Clear names reduce misassignment risk.
  5. Keep assignments layered and predictable. One device can belong to many groups, so policy precedence and overlap must be understood before rollout.
  6. Review stale pilot groups and one-off exclusions regularly; those are common sources of targeting drift.

Reference​