How to utilize Windows Autopilot Group Tags

In this post, we will explore how group tags can be used to organize devices into groups, enabling you to assign different Autopilot enrollment settings to each group with the same tag. Keep in mind, this is only one example of using group tags—there are many other potential use cases.

The Scenario

A college has acquired 100 Windows devices to be used by Professors, Students, and Accounting teams. The Professors’ devices will not be joined to the local on-prem domain, and the users will require local administrator privileges. The Students’ devices, on the other hand, will be joined to the local domain and will not have local administrator access. Each team will need a separate Autopilot deployment profile tailored to their specific requirements.

Step 1: First, we modify the .csv file by adding a new column called “Group Tag.” Next, we assign a tag, such as “Professor,” to the devices designated for the Professors team, “Student” to those for the Accounting team, and so on. Here is an example:

Step 2: The next step is to upload the device list to Intune. It is recommended to use the Intune portal for this upload, as outlined in the following article:

Enroll Windows devices in Intune by using the Windows Autopilot

After the .csv file is uploaded to Intune, the devices will display the same group tag information, as shown in the screenshot below.

Step 3: Next we’ll create a dynamic device group and add the devices into their respective groups. Details for creating a dynamic device group can be found here, and the query for the groups that we’ll use is this:

(device.devicePhysicalIds -any _ -eq “[OrderID]:Professor”)

Step 4: Next, we simply need to assign deployment profiles to each of these device groups. We won’t cover all the details of creating and assigning Windows Autopilot deployment profiles here, but you can find all the information you need in this guide. Once you’ve created and assigned the deployment profiles, you can check the profile status under Device Enrollment – Windows Enrollment -> Windows Autopilot Devices. Here’s an example:

That’s all there is to it. Now, when these devices are powered on, each one will be enrolled according to the settings of its assigned Autopilot deployment profile.