Match the full Autopilot correlator value in dynamic enrollment groups

Source facts

For existing-device deployments, Autopilot sets enrollmentProfileName to OfflineAutopilotprofile- followed by the configuration file’s correlator ID. Microsoft warns that a device can report a chosen correlator ID because the value is not preregistered in Intune. Its guidance requires matching the complete enrollmentProfileName value and avoiding Autopilot or Apple ADE profile names beginning with OfflineAutopilotprofile-. Microsoft Learn.

Applicability

Use this review when Windows Autopilot for existing devices relies on enrollmentProfileName for dynamic group membership. Limit the change to groups and profile names that participate in that workflow.

DSE recommendation

DSE recommends reviewing the exact membership expressions before using these groups to deliver configuration. Inventory each correlator value and the corresponding intended population. Replace partial comparisons with the documented complete-value comparison, and check profile naming conventions for the reserved prefix. Treat the correlator as an input to review, with an owner and documented purpose.

Verification

In a controlled enrollment test, compare the expected full attribute value with the actual record and resulting group membership. Include a deliberately different value to confirm that it stays outside the intended group. Review the applications and policies assigned to that group before approving the change. Retain the expression and observed membership evidence.

Official references

Microsoft Learn: Create device groups for Windows Autopilot. Source reviewed September 17, 2026.