Check group type and timing before relying on an Intune exclusion

Source facts

Intune does not resolve user-to-device relationships when a device-group assignment excludes a user group. A dynamic device exclusion can also arrive too late: policy may reach a newly enrolled device before its exclusion membership is calculated. Microsoft recommends assignment filters for latency-sensitive device exclusions. Microsoft Learn.

Applicability

Use this check for a proposed device-configuration exception, especially during enrollment. Identify whether both sides of the assignment contain users or devices, and whether the exception depends on newly calculated membership.

DSE recommendation

Write the intended exclusion as a concrete device-and-policy test case before changing assignments. Have the policy owner inspect the actual group object types and evaluate a supported filter where timing matters. Do not approve an exception merely because the excluded group has the correct department name. Keep a separate review for any cross-service use of those groups.

Verification

Use a representative test device with a newly created enrollment record, not only one whose membership has settled. Inspect whether the unwanted policy was ever offered and compare the result with the intended assignment. Include an eligible device as a positive control. Preserve the group definitions, filter expression where used, observation times, and actual policy result so the exception can be reassessed after targeting changes.

Official references

Microsoft Learn: Assign device profiles in Microsoft Intune.