How to Tag Intune Devices Automatically Based on Enrollment Method (BYOD, Corporate, Autopilot) Intune captures a wealth of enrollment and ownership data, but it's only useful if you can act on it. We're diving into the steps to tag Intune devices automatically based on enrollment metadata for precise, dynamic scoping. Before we begin, be sure to subscribe to NinjaOne's IT video hub and our YouTube channel for more tech content like this. Building an Accurate BYOD vs. Corporate Inventory The first step in any automation workflow is gaining full visibility into your current device fleet. First, install the Microsoft Graph PowerShell SDK module and connect using the DeviceManagementManagedDevices.Read.All permission scope. Then, define the specific properties you need, such as managedDeviceOwnerType and deviceEnrollmentType. Run the Get-MgDeviceManagementManagedDevice command to pull a complete list of all managed endpoints. Display the results in a table to differentiate between personal BYOD, corporate-owned, and Autopilot-enrolled devices. Use this inventory as your baseline to verify ownership and enrollment methods before applying any automated labels. Creating Persistent Device Labels for Better Visibility Once you have the data, you need a way to make those classifications permanent and searchable. First, connect to Microsoft Graph with directory write permissions to modify your Microsoft Entra device objects. Then, locate the specific device in Entra ID using the azureADDeviceId retrieved in the previous step. Use the Update-MgDevice command to write a custom label into the extensionAttributes field. Assign specific values like "BYOD" or "Corporate" to attribute fields for persistent cloud-based tracking. Finally, verify the update to ensure the tag is attached to the device object and remains available for automation and dynamic group membership. Streamlining Policy Targeting with Auto-Groups Dynamic groups allow you to turn your directory labels into automated policy-targeting mechanisms. First, navigate to the Entra admin center and create a new Security group with Dynamic Device membership. Build a rule based on device ownership, such as device.deviceOwnership -eq "Company". Optionally add enrollment profile filters to specifically target your Autopilot-provisioned hardware. Assign your compliance policies and required apps directly to these automatically populating groups. Finally, monitor the group membership to ensure devices are correctly scoped once dynamic membership processing completes. Ensuring Consistency with Scripted Local Tagging Local tagging ensures that your automation remains visible even when you are working directly on the endpoint. First, create a PowerShell script that identifies the device category based on enrollment and ownership information. Use the New-Item command to create a custom registry path at HKLM:\SOFTWARE\Org\IntuneTags. Stamp the enrollment type and a "LastUpdated" timestamp into the registry for RMM tracking. Deploy this script through Microsoft Intune, such as via a Win32 app, PowerShell script deployment, or Proactive Remediation where applicable. Finally, audit these registry keys regularly to prevent metadata drift and ensure local-to-cloud data consistency. Correct classification is the backbone of a Zero Trust security model. When you tag Intune devices automatically, you ensure that sensitive corporate data stays on corporate hardware and BYOD devices are appropriately restricted. For more information, check out our official blog post on How to Tag Intune Devices Automatically Based on Enrollment Method, linked in the description below.