Creating dynamic groups and filters for Microsoft devices

Last week I put out a helpful cross-platform reference for using the Operating System version property of devices when creating dynamic groups and filters while working with Microsoft Endpoint manager. Since folks found that helpful, I thought I’d add some common filter scenarios for using the Manufacturer and Model properties on Windows 10 and 11 devices.

You can either copy the rules from here or use the Github link to copy the latest updated version.

Note: These examples are written for Intune filters. If you want to create dynamic device groups in Azure AD you’ll need to update the property names. Replace device.manufacturer with device.deviceManufacturer and device.model with device.deviceModel.

Surface hub devices (Copy from github)

I used the -eq operator and added the three current models of surface hub on the market but you could also get away with -startswith operator to capture them all in a simpler (and more future-proof) way.

(device.manufacturer -eq "Microsoft Corporation")
and 
((device.model -eq "Surface Hub 84")
or (device.model -eq "Surface Hub 55")
or (device.model -eq "Surface Hub 2S"))

Hololens devices (Copy from github)

In this example, I specified the two models by their explicit model name, but you could make this simpler using -startswith.

(device.manufacturer -eq "Microsoft Corporation") 
and 
((device.model -eq "HoloLens 2") 
or (device.model -eq "HoloLens"))

Hyper-V Virtual machines (Copy from github)

(device.manufacturer -eq "Microsoft Corporation") 
and (device.model -eq "Virtual Machine")

Windows 365 devices (Copy from github)

Since all Windows 365 models all start with the word “CloudPC” I used the -startswith operator but you could also use -eq operator if you want to target a specific size device, for example “Cloud PC Enterprise 2vCPU/8GB/128GB”

(device.manufacturer -eq "Microsoft Corporation") 
and 
(device.model -startswith "Cloud PC")

Surface Laptops and Desktops (Copy from github)

I could have used the -contains operator for “Surface” in this example but I wanted to make sure it was clear that Surface Studio (not a laptop) would also be included. Adjust it as you see fit :)

(device.manufacturer -eq "Microsoft Corporation") 
and 
((device.model -eq "Surface 2")
or (device.model -eq "Surface 3")
or (device.model -startsWith "Surface Book")
or (device.model -startsWith "Surface Go")
or (device.model -startsWith "Surface Laptop")
or (device.model -startsWith "Surface Pro")
or (device.model -startsWith "Surface Studio"))

Let me know if these samples help you and I’ll add some more!

-Scott