Capture the actual Zebra LifeGuard deployment population at creation

Source facts

Intune sends eligible Zebra devices to LifeGuard OTA when the deployment is created. Devices added to the assigned group afterward are not included. Removing a device from the group afterward may not prevent its update. These deployments cannot be edited after creation. A deployment for later additions must be created separately. Microsoft Learn.

Applicability

Use this check when scheduling or auditing an Intune-integrated Zebra LG OTA deployment. Confirm service enrollment and device eligibility before treating current group membership as the target list.

DSE recommendation

Retain the eligible device population at creation alongside the deployment identifier. Plan a separate reconciliation for devices enrolled later, and handle removal requests as a deployment-control issue rather than a group-edit shortcut. Have the operations owner approve the captured population before a future-dated deployment is submitted.

Verification

Compare the submitted population, present group members, and device-level deployment results. In an authorized pilot, distinguish a later-added device from one included at creation, without relying on a production firmware downgrade for testing. Resolve any removal request against the actual deployment state. Preserve device identifiers and observed firmware outcomes so a later auditor can explain why current membership differs from the machines processed.

Official references

Microsoft Learn: Zebra LifeGuard Over-the-Air Integration with Microsoft Intune.