Setup guide · from scratch
Create an Entra dynamic device group for corporate Android Enterprise devices
Targets corporate Android devices automatically by attribute. Enrol one canary device FIRST and read its real deviceOSType — 'AndroidEnterprise' catches fully managed/dedicated but misses BYOD work profile ('AndroidForWork').
Step 1. Enrol ONE test corporate Android device first so you can read its real attributes.
Screenshot: Test device enrolled in Intune (captured during a live customer build — coming to this page)
Step 2. Go to Intune > Groups > New group; set type 'Security' and Membership type 'Dynamic Device'.
Screenshot: New group blade with Dynamic Device selected (captured during a live customer build — coming to this page)
Step 3. Click 'Add dynamic query' > 'Edit' to open the rule syntax box.
Screenshot: Dynamic rule syntax editor (captured during a live customer build — coming to this page)
Step 4. Paste: (device.deviceOSType -eq "AndroidEnterprise") and (device.deviceOwnership -eq "Company").
Screenshot: Membership rule pasted in the editor (captured during a live customer build — coming to this page)
Step 5. Save the rule and the group; wait several minutes for asynchronous evaluation.
Screenshot: Group created, evaluation pending (captured during a live customer build — coming to this page)
Step 6. VALIDATE: open the test device, confirm OS/ownership and that it landed in Members; if corporate devices are missed, check for a different deviceOSType and widen with -startsWith "Android" plus an ownership filter.
Screenshot: Group > Members with the test device; device Overview showing OS = Android (Enterprise) and Ownership = Corporate (captured during a live customer build — coming to this page)
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access