Setup guide · from scratch
Create a dynamic Autopilot device group (touchless Windows targeting)
Targets Autopilot Windows devices before OOBE. Build the rule ONLY on Autopilot attributes (ZTDId or group-tag OrderID) — they populate only after registration. Requires Entra ID P1.
Step 1. In Intune > Groups > New group set type 'Security' and 'Entra roles can be assigned to the group' = No.
Screenshot: New group blade, type Security (captured during a live customer build — coming to this page)
Step 2. Set Membership type to 'Dynamic Device'.
Screenshot: Membership type = Dynamic Device (captured during a live customer build — coming to this page)
Step 3. Click 'Add dynamic query' > 'Edit'.
Screenshot: Dynamic rule syntax editor (captured during a live customer build — coming to this page)
Step 4. For ALL Autopilot devices paste (device.devicePhysicalIDs -any (_ -startsWith "[ZTDId]")); or for a group tag paste (device.devicePhysicalIds -any (_ -eq "[OrderID]:<groupTag>")).
Screenshot: Autopilot membership rule pasted in (captured during a live customer build — coming to this page)
Step 5. For Autopilot-for-existing-devices, target the FULL enrollmentProfileName value to avoid spoofed-correlator collisions.
Screenshot: enrollmentProfileName rule variant (captured during a live customer build — coming to this page)
Step 6. Save, then Create; membership evaluates asynchronously (allow longer at scale).
Screenshot: Group Overview showing membership count > 0 once devices evaluate (captured during a live customer build — coming to this page)
See it on a real device.
Decolla is in private build — early-access members see a build defined, deployed and rolled back first.
Get early access