# Match the full Autopilot correlator value in dynamic enrollment groups

> How should dynamic groups avoid unintended matches from an Autopilot existing-device correlator ID?

- Canonical URL: https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/
- Publisher: Detection Systems & Engineering (DSE Security)
- Author: DSE Security Editorial Team
- Published: 2026-09-17T16:34:58+00:00
- Modified: 2026-09-17T16:35:03+00:00
- Last reviewed by DSE: 2026-09-17
- Resource type: Guide
- DSE priority: Information
- Topics: Cybersecurity, IT
- Reading time: 1 minutes

## What you need to know

How should dynamic groups avoid unintended matches from an Autopilot existing-device correlator ID?

## Potentially affected

Use this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.

## DSE recommendation

DSE recommends reviewing the exact membership expressions before using these groups to deliver configuration.

## Article

## Source facts

For existing-device deployments, Autopilot sets enrollmentProfileName to OfflineAutopilotprofile- followed by the configuration file’s correlator ID. Microsoft warns that a device can report a chosen correlator ID because the value is not preregistered in Intune. Its guidance requires matching the complete enrollmentProfileName value and avoiding Autopilot or Apple ADE profile names beginning with OfflineAutopilotprofile-. [Microsoft Learn](https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot).

## Applicability

Use this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.

## DSE recommendation

DSE recommends reviewing the exact membership expressions before using these groups to deliver configuration. Inventory each correlator value and the corresponding intended population. Replace partial comparisons with the documented complete-value comparison, and check profile naming conventions for the reserved prefix. Treat the correlator as an input to review, with an owner and documented purpose.

## Verification

In a controlled enrollment test, compare the expected full attribute value with the actual record and resulting group membership. Include a deliberately different value to confirm that it stays outside the intended group. Review the applications and policies assigned to that group before approving the change. Retain the expression and observed membership evidence.

## Official references

[Microsoft Learn: Create device groups for Windows Autopilot](https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot). Source reviewed September 17, 2026.

## Primary reference

- Name: Create device groups for Windows Autopilot | Microsoft Learn
- Authority: Microsoft Learn
- URL: https://learn.microsoft.com/en-us/autopilot/enrollment-autopilot
- Source publication date: Not stated by the source

## Citation and use

Preferred citation: “Match the full Autopilot correlator value in dynamic enrollment groups,” DSE Security, https://update.dsesecurity.com/updates/dse-20260917-002-match-the-full-autopilot-correlator-value-in-dynamic-enrollment-groups/
Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/
Usage and citation policy: https://update.dsesecurity.com/usage/
Copyright © 2026 Detection Systems & Engineering. All rights reserved.