To group Cloud PCs in a Microsoft Entra ID dynamic device group, create a Security group in the Microsoft Intune admin center, choose Dynamic Device membership, and build a rule for either one provisioning policy or all Cloud PCs. For a policy-specific group, match the exact enrollmentProfileName; for all Cloud PCs, match the documented device-model prefixes. Validate the rule against both intended and unintended devices before using the group for assignments.
What the group does—and what it does not do
Azure Active Directory (Azure AD) is now called Microsoft Entra ID in Microsoft documentation. A dynamic device group contains device objects selected by device attributes; it is distinct from the user group assigned to a Windows 365 provisioning policy. That policy targets Entra user groups, and licensed users in those groups receive Cloud PCs. The dynamic device group is for targeting the resulting Cloud PC devices.
As an Amazon Associate I earn from qualifying purchases.
A Windows 365 provisioning policy is an Intune object that orchestrates Cloud PC creation and specifies settings such as network and image. Changing a policy does not automatically reprovision existing Cloud PCs; changes apply to newly provisioned or manually reprovisioned Cloud PCs. Renaming a policy also does not change an existing Cloud PC’s name or its enrollmentProfileName value in Entra ID. If a rule matches that value, verify the actual device attribute rather than assuming it followed a rename. Microsoft’s provisioning-policy documentation explains the policy’s role.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Create a group for Cloud PCs from one provisioning policy
- In the Microsoft Intune admin center, go to Groups > New Group.
- Set Group type to Security, then enter a descriptive group name and purpose.
- Set Membership type to Dynamic Device, then select Add dynamic query.
- Add the rule
enrollmentProfileNameEquals the exact provisioning policy name used in your tenant. For example, Microsoft shows the valueUX Engineering; use your own exact policy name instead. - If the same enrollment profile name may be used by another enrollment workflow, add an AND condition:
deviceModelContainsCloud PC. - Select Validate Rules (Preview) and check representative devices before creating the group.
- Review the results, then save and create the group.
The rule expression with the extra Cloud PC check is:
#1 Best Overall
- A PREMIUM PERFORMANCE LAPTOP — Ready for work, school, and creativity. Built for busy days, big projects, and nonstop multitasking. Run video calls, school and work apps, 20+ browser tabs, and AI tools at the same time without slowing down.
- WITH AI BUILT IN — With a dedicated AI chip (Qualcomm Snapdragon X2 Elite), this Copilot+ PC[5] on Windows 11 helps you work smarter and faster. Prompt, create, and automate with ease - ready for even your most demanding tasks.
- A 13.8" TOUCHSCREEN YOU'LL ACTUALLY USE — Sharp colors, real detail, smooth 120Hz scrolling on the PixelSense touchscreen[1] with LCD display[2]. Tap, scroll, or pinch to zoom - whichever feels right for streaming, editing photos, or daily work.
- 20 HOURS OF BATTERY (LEAVE THE CHARGER) — Up to 20 hours of video playback[3] on a single charge. Work from a coffee shop, take it to class/work, or binge an entire season on a long flight — it'll keep up.
- THE PORTS YOU NEED — Two USB-C / USB4[4] ports for fast charging, big file transfers, or hooking up to three 4K monitors when you want a full desktop. Wi-Fi 7 keeps you online and fast wherever you are.
(device.enrollmentProfileName -eq "UX Engineering") -and (device.deviceModel -contains "Cloud PC")Replace UX Engineering with the exact value in your tenant. The second condition is a collision safeguard when an enrollment profile name is reused; when the name is unique, the documented base rule is just the enrollment-profile equality test. Microsoft’s policy-specific group instructions show the rule-builder approach.
What to check during validation
- Cloud PCs created from the intended provisioning policy should match.
- Cloud PCs created from another policy should not match.
- Non-Cloud-PC devices should not match, particularly if you have reused the profile name.
Create a group containing all Cloud PCs
Use this when the target is every Cloud PC rather than devices from one provisioning policy. Create a Security group with Dynamic Device membership as above, then add two device-model conditions joined by OR:
Rank #2
- [This is a Copilot+ PC] — The fastest, most intelligent Windows PC ever, with built-in AI tools that help you write, summarize, and multitask — all while keeping your data and privacy secure.
- [The Power of a Laptop, the Flexibility of a Tablet] — Surface Pro 12” is a 2-in-1 device that adapts to you. Use it as a tablet for on-the-go tasks, prop it up with the built-in kickstand, or attach the Surface Pro Keyboard (sold separately) to turn it into a full laptop.
- [Incredibly Fast and Intelligent] — Powered by the latest Snapdragon X Plus processor and an AI engine that delivers up to 45 trillion operations per second — for smooth, responsive, and smarter performance.
- [All Day Battery Life] — Up to 16 hours of battery life[1] means you can work, stream, and create wherever the day takes you — without reaching for a charger.
- [Brilliant 12” Touchscreen Display] — The PixelSense display delivers vibrant color and crisp detail in a sleek design — perfect for work, entertainment, or both.
device.deviceModel -startsWith "Cloud PC" -or device.deviceModel -startsWith "Windows 365"In the rule builder, set the first property to deviceModel, operator to Starts With, and value to Cloud PC. Add the second deviceModel condition with Starts With and value Windows 365, joined with OR. Validate that expected Cloud PCs match and non-Cloud-PC devices do not before saving. These are Microsoft’s documented prefixes for an all-Cloud-PC group. See Microsoft’s all-Cloud-PC rule instructions.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Choose a dynamic group or an Intune assignment filter
A dynamic device group is useful when membership must be available beyond a single Intune assignment—for example, for cross-workload targeting such as Conditional Access, licensing, or Autopilot assignment. If the only goal is to target an Intune app, policy, or profile using device properties, an assignment filter may be more suitable: Microsoft describes filters as evaluated at device check-in, without waiting for group-membership processing.
Rank #3
- [This is a Copilot+ PC] — The fastest, most intelligent Windows PC ever, with built-in AI tools that help you write, summarize, and multitask — all while keeping your data and privacy secure.
- [The Power of a Laptop, the Flexibility of a Tablet] — Surface Pro 12” is a 2-in-1 device that adapts to you. Use it as a tablet for on-the-go tasks, prop it up with the built-in kickstand, or attach the Surface Pro Keyboard (sold separately) to turn it into a full laptop.
- [Incredibly Fast and Intelligent] — Powered by the latest Snapdragon X Plus processor and an AI engine that delivers up to 45 trillion operations per second — for smooth, responsive, and smarter performance.
- [All Day Battery Life] — Up to 16 hours of battery life[1] means you can work, stream, and create wherever the day takes you — without reaching for a charger.
- [Brilliant 12” Touchscreen Display] — The PixelSense display delivers vibrant color and crisp detail in a sleek design — perfect for work, entertainment, or both.
| Decision | Dynamic device group | Intune assignment filter |
|---|---|---|
| Main scope | Entra device-group membership; can support cross-workload targeting. | Filters devices or apps within an Intune assignment. |
| Best fit | Target is needed beyond one Intune assignment, such as Conditional Access, licensing, or Autopilot. | A device-property filter is sufficient for an Intune app, policy, or profile. |
| Evaluation | Dynamic membership rules evaluate device attributes for group membership; processing time is tenant-dependent. | Microsoft says the filter is evaluated at device check-in without waiting on group-membership processing. |
For details on groups and filtering, consult Microsoft’s Intune assignment-filter guidance and Microsoft Entra dynamic-membership documentation.
Quick Recap
Rank #4
- Brilliant Display – Stunning 13.8" PixelSense touchscreen[1], with brilliant LCD display[2], unleashes luminous whites, deeper blacks and colors so richly saturated bringing vivid life into every frame – perfect for work, school, streaming and creative tasks.
- Power that lasts all day – With 20 hours of battery life[3], the new Surface Laptop powers through your entire day, so you can create, work and stream from morning to night without reaching for a charger.
- Work at the speed of your ideas – Built with the latest Qualcomm Snapdragon X2 Elite (12 Core) processors, Surface Laptop delivers fast, AI‑accelerated performance—making it the most powerful Surface laptop for everything from multitasking to demanding workloads.
- The ports you need – Charge on-the-go, transfer data fast, or create the ultimate desktop set up with two USB-C / USB4[4] ports.
- Built-in AI Companion – Work smarter, create freely, and communicate with confidence—Copilot[5] on Windows 11 is always there to help.
Licensing and operational cautions
- Windows 365 users need an applicable Windows 365 license to use a Cloud PC. Windows 365 Enterprise supports individual and Entra group-based license assignment; Windows 365 Flex licenses are assigned at tenant level and selected when creating provisioning policies. Check Microsoft’s Windows 365 requirements and licensing guidance.
- Microsoft says no specific Entra ID license is required for members of dynamic device groups. That does not remove the separate Windows 365 licensing requirement for users who need Cloud PCs. Microsoft’s dynamic-membership guidance covers the group-member licensing point.
- Keep a dynamic device group device-only; do not mix user and device membership in one dynamic group.
- Do not assume a policy edit updates existing Cloud PCs, or that a renamed provisioning policy updates their
enrollmentProfileName. Verify the device property used by your rule. - Membership-processing time is not guaranteed; check group membership in your own tenant before relying on it for a time-sensitive assignment.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
