Menu
Modern Workplace Blog
  • Home
  • About: Kenneth van Surksum
  • Cookie Policy
Modern Workplace Blog
May 11, 2021May 18, 2021

A first look at filtering when assigning apps, compliance policies and configuration profiles in Microsoft Endpoint Manager

Microsoft is currently in the process of rolling out a preview of filtering for apps, policies and profiles in Microsoft Endpoint Manager.

With this new functionality you will be able to define extra applicability conditions for Apps, compliance policies and configuration profiles. Not every workload is supported (yet) though, for example you cannot use the filtering functionality while using a Settings Catalog configuration profile (at this point in time), you also cannot use filtering in Windows 10 Update rings and Windows 10 Feature updates. If you want to know what workloads and features are supporting filtering, check out this documentation article first.

Filtering overview

With filtering you can assign an app or policy to a user or device group, while filtering specific devices in and out of the assignment. Filters can be configured to either include or exclude devices from the assignment, so you do not have to spend time selecting those devices in Intune or waiting for dynamic device group membership to be calculated.

Before you can use the filtering functionality, you have to enable the preview functionality first. This can be done from the Tenant Administration settings in the Microsoft Endpoint Manager Admin Center. You need to click on the hyperlink for “Try out the filters (preview) feature!” for the option to enable filters to appear.

Enable filters (Preview)

Once enabled you can centrally create filters by clicking on the + Create button under Filters (preview). After providing a name for the filter (mandatory), a description (optional) and the platform (iOS/iPadOS, Windows 10, Android device administrator, macOS or Android Enterprise) you can define the ruleset.

 This ruleset is similar to the ruleset available when creating Azure AD dynamic device groups, as shown in the figure below (1) displays the options for creating a dynamic device group and (2) shows the options for creating a filter.

Azure AD Dynamic Membership rules versus MEM filter

Depending on the platform chosen properties are available to use while creating the filter rule. For Windows 10 the following properties are available:

  • deviceName
  • manufacturer
  • model
  • deviceCategory
  • osVersion
  • deviceOwnership
  • enrollmentProfilename
  • operatingSystemSKU

Which propertiesare supported for which platform is detailed in the following article: Device properties, operators, and rule editing when creating filters in Microsoft Endpoint Manager

Below is an example of you a filter could look like, in this case we create a filter where the Operations System SKU is either Professional or ServerRdsh. ServerRdsh is the SKU for Windows Enterprise for Virtual Desktops for which Microsoft is currently rolling out supporting this SKU with Microsoft Endpoint Manager.

Rule builder with Rule syntax result

Once one or more filters are created, the filter can be used while creating assignments on supported workloads.

Use filter to exclude filtered devices in assignment

After the filter has been added you can see this reflected in the assignments for the workload you configured. The Assignment will reflect the name of the filter and whether the devices in the filter will be included or excluded.

Overview of used filtering in assignment view

Conclusion

This new functionality opens up a lot of possible scenario’s, I could use a filter for example to exclude Virtual Machines from my default Compliance Policy for example, or filter out Windows 10 Professional from my Start Menu customization. Allowing me to reduce the issues I receive and challenges I face for any exceptions in my environment.

As written in my article titled: “Designing and building your Microsoft Endpoint Manager/Intune environment for Operations” I outlined why I prefer to use one Azure AD user group to rule them all. With these filter capabilities I can find a solution for some of the scenario’s which weren’t that easy to implement because of my design choices.

From today I will start experimenting with the functionality in my demo tenant and explore its capabilities. I already know for sure though that filtering will become part of my standard Modern Workplace implementation solution.

Reference

Use filters when assigning your apps, policies, and profiles in Microsoft Endpoint Manager

Device properties, operators, and rule editing when creating filters in Microsoft Endpoint Manager

List of platforms, policies, and app types supported by filters in Microsoft Endpoint Manager

Filter reports and troubleshooting in Microsoft Endpoint Manager

Use Microsoft Endpoint Manager filters to target apps and policies to specific devices

Filters Public Preview – Overview and Known Issues

Tweet
Follow me
Tweet #WPNinjasNL

2 thoughts on “A first look at filtering when assigning apps, compliance policies and configuration profiles in Microsoft Endpoint Manager”

  1. Pingback: A first look at using Filters for devices as conditions in Azure AD Conditional Access policies | Modern Workplace Blog
  2. Pingback: A first look at using Filters for devices as conditions in Azure AD Conditional Access policies - Tech Daily Chronicle

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Founding member of:

Recent Posts

  • MAM vs. MDM: Choosing the Right Mobile Management Approach
  • Comparing Web Filtering and Security: Microsoft Entra Internet Access (Global Secure Access) vs. Microsoft Defender for Endpoint (MDE)
  • Navigating New Authentication Methods: SMS for Password Reset, Not for MFA
  • From SPF to DANE: Securing Microsoft 365 Email Communications
  • Protecting your Break Glass accounts in Entra now that MFA gets enforced on more and more Admin portals

Books

System Center 2012 Service Manager Unleashed
Amazon
System Center 2012 R2 Configuration Manager Unleashed: Supplement to System Center 2012 Configuration Manager
Amazon
System Center Configuration Manager Current Branch Unleashed
Amazon
Mastering Windows 7 Deployment
Amazon
System Center 2012 Configuration Manager (SCCM) Unleashed
Amazon

Archives

  • February 2025
  • January 2025
  • September 2024
  • February 2024
  • January 2024
  • December 2023
  • November 2023
  • September 2023
  • August 2023
  • February 2023
  • December 2022
  • November 2022
  • October 2022
  • September 2022
  • August 2022
  • May 2022
  • February 2022
  • January 2022
  • December 2021
  • November 2021
  • October 2021
  • September 2021
  • July 2021
  • June 2021
  • May 2021
  • April 2021
  • March 2021
  • February 2021
  • January 2021
  • December 2020
  • November 2020
  • October 2020
  • September 2020
  • August 2020
  • July 2020
  • June 2020
  • May 2020
  • April 2020
  • March 2020
  • February 2020
  • January 2020
  • December 2019
  • November 2019
  • October 2019
  • August 2019
  • July 2019
  • November 2016
  • November 2015
  • June 2015
  • May 2015
  • November 2014
  • July 2014
  • April 2014
  • March 2014
  • February 2014
  • January 2014
  • November 2013
  • August 2013
  • April 2013
  • March 2013
  • January 2013
  • December 2012
  • November 2012
  • August 2012
  • July 2012
  • June 2012

Meta

  • Log in
  • Entries feed
  • Comments feed
  • WordPress.org

Categories

  • ABM (4)
  • Advanced Threat Protection (4)
  • Announcement (44)
  • Azure (3)
  • AzureAD (73)
  • Certification (2)
  • Cloud App Security (5)
  • Conditional Access (58)
  • Configuration Manager (24)
  • Entra (2)
  • Entra Id (8)
  • Events (14)
  • Exchange Online (9)
  • Identity Protection (5)
  • Intune (27)
  • Licensing (2)
  • Microsoft Defender (1)
  • Microsoft Defender for Endpoint (1)
  • Microsoft Endpoint Manager (35)
  • Mobile Application Management (4)
  • Modern Workplace (74)
  • Office 365 (10)
  • Overview (11)
  • Power Platform (1)
  • PowerShell (2)
  • Presentations (9)
  • Privileged Identity Management (5)
  • Role Based Access Control (2)
  • Security (63)
  • Service Manager (4)
  • Speaking (30)
  • Troubleshooting (4)
  • Uncategorized (11)
  • Windows 10 (15)
  • Windows 11 (5)
  • Windows Update for Business (4)
  • WMUG.nl (16)
  • WPNinjasNL (32)

Tags

#ABM #AzureAD #community #conditionalaccess #ConfigMgr #IAM #Intune #m365 #MEM #MEMCM #microsoft365 #modernworkplace #office365 #security #webinar #wmug_nl ATP authentication strength AzureAD Branding Community Conditional Access ConfigMgr ConfigMgr 2012 Email EXO Identity Intune Licensing M365 MCAS MFA Modern Workplace Office 365 OSD PIM Policy Sets Presentation RBAC roles Security System Center Task Sequence troubleshooting webinar

Recent Comments

  • brc on Protecting your Break Glass accounts in Entra now that MFA gets enforced on more and more Admin portals
  • [m365weekly] #186 – M365 Weekly Newsletter on MAM vs. MDM: Choosing the Right Mobile Management Approach
  • Dean Gross on Comparing Web Filtering and Security: Microsoft Entra Internet Access (Global Secure Access) vs. Microsoft Defender for Endpoint (MDE)
  • nikhil tech on Protecting your Break Glass accounts in Entra now that MFA gets enforced on more and more Admin portals
  • Kenneth on Comparing Web Filtering and Security: Microsoft Entra Internet Access (Global Secure Access) vs. Microsoft Defender for Endpoint (MDE)

This information is provided “AS IS” with no warranties, confers no rights and is not supported by the author.

Copyright © 2021 by Kenneth van Surksum. All rights reserved. No part of the information on this web site may be reproduced or posted in any form or by any means without the prior written permission of the publisher.

Shorthand: Don’t pass off my work as yours, it’s not nice.

©2025 Modern Workplace Blog | Powered by WordPress and Superb Themes!
Menu
Modern Workplace Blog
  • Home
  • About: Kenneth van Surksum
  • Cookie Policy
This website uses cookies to improve your experience. We'll assume you're ok with this, but you can opt-out if you wish. Cookie settingsACCEPT
Privacy & Cookies Policy

Privacy Overview

This website uses cookies to improve your experience while you navigate through the website. Out of these cookies, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities...
Necessary
Always Enabled
Necessary cookies are absolutely essential for the website to function properly. This category only includes cookies that ensures basic functionalities and security features of the website. These cookies do not store any personal information.
Non-necessary
Any cookies that may not be particularly necessary for the website to function and is used specifically to collect user personal data via analytics, ads, other embedded contents are termed as non-necessary cookies. It is mandatory to procure user consent prior to running these cookies on your website.
SAVE & ACCEPT