{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "item": { "id": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "slug": "dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups", "url": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups.md", "json": "https://update.dsesecurity.com/api/v1/posts/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/" }, "title": "Match the full Autopilot correlator value in dynamic enrollment groups", "summary": "How should dynamic groups avoid unintended matches from an Autopilot existing-device correlator ID?", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-09-17T16:34:58+00:00", "modified_at": "2026-09-17T16:35:03+00:00", "reviewed_on": "2026-09-17", "reading_minutes": 1, "word_count": 210, "potentially_affected": "Use this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.", "dse_recommendation": "DSE recommends reviewing the exact membership expressions before using these groups to deliver configuration.", "primary_source": { "name": "Create device groups for Windows Autopilot | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot", "published_on": null, "authority": "Microsoft Learn" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Source facts

\n

For existing-device deployments, Autopilot sets enrollmentProfileName to OfflineAutopilotprofile- followed by the configuration file’s correlator ID. Microsoft warns that a device can report a chosen correlator ID because the value is not preregistered in Intune. Its guidance requires matching the complete enrollmentProfileName value and avoiding Autopilot or Apple ADE profile names beginning with OfflineAutopilotprofile-. Microsoft Learn.

\n

Applicability

\n

Use this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.

\n

DSE recommendation

\n

DSE recommends reviewing the exact membership expressions before using these groups to deliver configuration. Inventory each correlator value and the corresponding intended population. Replace partial comparisons with the documented complete-value comparison, and check profile naming conventions for the reserved prefix. Treat the correlator as an input to review, with an owner and documented purpose.

\n

Verification

\n

In a controlled enrollment test, compare the expected full attribute value with the actual record and resulting group membership. Include a deliberately different value to confirm that it stays outside the intended group. Review the applications and policies assigned to that group before approving the change. Retain the expression and observed membership evidence.

\n

Official references

\n

Microsoft Learn: Create device groups for Windows Autopilot. Source reviewed September 17, 2026.

", "content_text": "Source facts\nFor existing-device deployments, Autopilot sets enrollmentProfileName to OfflineAutopilotprofile- followed by the configuration file’s correlator ID. Microsoft warns that a device can report a chosen correlator ID because the value is not preregistered in Intune. Its guidance requires matching the complete enrollmentProfileName value and avoiding Autopilot or Apple ADE profile names beginning with OfflineAutopilotprofile-. Microsoft Learn.\nApplicability\nUse this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.\nDSE recommendation\nDSE recommends reviewing the exact membership expressions before using these groups to deliver configuration. Inventory each correlator value and the corresponding intended population. Replace partial comparisons with the documented complete-value comparison, and check profile naming conventions for the reserved prefix. Treat the correlator as an input to review, with an owner and documented purpose.\nVerification\nIn a controlled enrollment test, compare the expected full attribute value with the actual record and resulting group membership. Include a deliberately different value to confirm that it stays outside the intended group. Review the applications and policies assigned to that group before approving the change. Retain the expression and observed membership evidence.\nOfficial references\nMicrosoft Learn: Create device groups for Windows Autopilot. Source reviewed September 17, 2026.", "content_markdown": "## Source facts\n\nFor existing-device deployments, Autopilot sets enrollmentProfileName to OfflineAutopilotprofile- followed by the configuration file’s correlator ID. Microsoft warns that a device can report a chosen correlator ID because the value is not preregistered in Intune. Its guidance requires matching the complete enrollmentProfileName value and avoiding Autopilot or Apple ADE profile names beginning with OfflineAutopilotprofile-. [Microsoft Learn](https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot).\n\n## Applicability\n\nUse this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.\n\n## DSE recommendation\n\nDSE recommends reviewing the exact membership expressions before using these groups to deliver configuration. Inventory each correlator value and the corresponding intended population. Replace partial comparisons with the documented complete-value comparison, and check profile naming conventions for the reserved prefix. Treat the correlator as an input to review, with an owner and documented purpose.\n\n## Verification\n\nIn a controlled enrollment test, compare the expected full attribute value with the actual record and resulting group membership. Include a deliberately different value to confirm that it stays outside the intended group. Review the applications and policies assigned to that group before approving the change. Retain the expression and observed membership evidence.\n\n## Official references\n\n[Microsoft Learn: Create device groups for Windows Autopilot](https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot). Source reviewed September 17, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "url": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-09-17" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Match the full Autopilot correlator value in dynamic enrollment groups", "item": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/#article", "identifier": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "url": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/", "headline": "Match the full Autopilot correlator value in dynamic enrollment groups", "description": "How should dynamic groups avoid unintended matches from an Autopilot existing-device correlator ID?", "abstract": "How should dynamic groups avoid unintended matches from an Autopilot existing-device correlator ID?", "articleBody": "Source facts\nFor existing-device deployments, Autopilot sets enrollmentProfileName to OfflineAutopilotprofile- followed by the configuration file’s correlator ID. Microsoft warns that a device can report a chosen correlator ID because the value is not preregistered in Intune. Its guidance requires matching the complete enrollmentProfileName value and avoiding Autopilot or Apple ADE profile names beginning with OfflineAutopilotprofile-. Microsoft Learn.\nApplicability\nUse this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.\nDSE recommendation\nDSE recommends reviewing the exact membership expressions before using these groups to deliver configuration. Inventory each correlator value and the corresponding intended population. Replace partial comparisons with the documented complete-value comparison, and check profile naming conventions for the reserved prefix. Treat the correlator as an input to review, with an owner and documented purpose.\nVerification\nIn a controlled enrollment test, compare the expected full attribute value with the actual record and resulting group membership. Include a deliberately different value to confirm that it stays outside the intended group. Review the applications and policies assigned to that group before approving the change. Retain the expression and observed membership evidence.\nOfficial references\nMicrosoft Learn: Create device groups for Windows Autopilot. Source reviewed September 17, 2026.", "datePublished": "2026-09-17T16:34:58+00:00", "dateModified": "2026-09-17T16:35:03+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Match the full Autopilot correlator value in dynamic enrollment groups" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 210, "timeRequired": "PT1M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "Create device groups for Windows Autopilot | Microsoft Learn", "url": "https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot" } } ] } }