Create and manage groups for app assignment

We have already looked at the process of assigning apps to groups, thereby making the app available to users. However, it’s important that you also know how to create groups. You can then assign apps to those groups.

In Intune, there are two different group types. These groups are stored in Azure AD. These groups are:

• Security These groups are used for assigning permissions on Office 365 resources.
• Microsoft 365 These groups are used for collaboration between users.

From the app distribution perspective, the only significant difference is that security groups can contain devices as members, whereas Microsoft 365 groups can only contain users; that might not make any difference because in many organizations, devices are associated with a specific user.

After you have selected the type of the group, you must select the membership type. There are three membership types:

• Assigned You specify the membership of the group by selecting users.
• Dynamic user You define membership by creating a query that selects users automatically.
• Dynamic device You define membership by creating a query that selects devices, as displayed in Figure 4-25.

Figure 4-25 Reviewing the properties of a dynamic device group

 Exam Tip

The ability to use dynamic groups is restricted to Azure AD premium editions.

Remember, only security groups can contain devices. To create groups in the Microsoft Endpoint Manager admin center, use the following procedure:

1. Select the Groups node in the navigation pane, and then select New Group.
2. Select the group type from the list.
3. Enter a group name.
4. Enter a group description (optional).
5. Select the membership type, and complete one of the following steps:

• If you choose Assigned, select the No members selected link, and add the members to the group. Then select Create.
  • If you choose Dynamic user, select Add dynamic query, and then select Edit to manually enter a query. Otherwise, use the Add expression link to build a query. When you’re finished, select Save.
  • If you choose Dynamic device, then select Add dynamic query, and then select Edit to manually enter a query. Otherwise, use the Add expression link to build a query. When you’re finished, select Save.

6. Review your choices, and then select Create.

After you create the group, you can assign apps to the group, as described in the “Add a Microsoft store app” section, earlier in this chapter.

Need More Review? Compare Groups

To review further details about groups in Intune, refer to the Microsoft website at https://docs.microsoft.com/office365/admin/create-groups/compare-groups.