Check cross-service consumers before replacing an Intune targeting group

Source facts

Intune assignment filters refine a group assignment using device properties at check-in. Other services such as Conditional Access and SharePoint require Entra group membership and cannot consume those filters. Autopilot profile assignment also requires groups. Microsoft warns that a misconfigured or deleted filter on a broad assignment can affect every device in its scope. Microsoft Learn.

Applicability

Consider this simplification only for a group used solely for Intune targeting. Confirm that the particular policy or app supports filters; Microsoft explicitly excludes unsupported workloads from this approach.

DSE recommendation

List every consumer of the current group before proposing its removal. Separate its organizational identity role from the device-property condition needed by Intune. Translate the condition against the supported filter property names and values rather than copying a dynamic-membership expression literally. Preserve the original assignment until the proposed audience has been reviewed and a bounded pilot accepted.

Verification

Compare expected included and excluded devices with actual assignment results in the pilot. Test an endpoint whose relevant property differs and confirm that it remains outside the intended payload. Ask each cross-service owner to confirm whether they still require the original group. Expand only with a documented audience comparison and an approved reversal plan. Do not delete a shared group merely because an Intune policy appears to work without it.

Official references

Microsoft Learn: Choose the right targeting method in Microsoft Intune.