agent's autopilot assignment picked the wrong group: dynamic group rule bug

TL;DR

Test the dynamic rule against the real device set before the agent uses it for assignment. Preview which devices the rule matches, tighten the rule until only the intended devices match, and re-preview after every change.

Steps

1. Preview the dynamic group membership in Entra ID before assigning anything. Expected: The preview lists exactly which devices match.

2. Compare the preview against the intended device list and find the over-matched devices. Expected: The rule's overreach is visible.

3. Tighten the rule with additional attributes until the preview matches intent exactly. Expected: Only the right devices match.

4. Have the agent re-check the preview on each run before assigning profiles. Expected: Drift is caught before it assigns.

When to use

• The agent assigns Autopilot profiles via dynamic groups
• Devices received the wrong Autopilot profile
• The rule uses broad attributes like OS version alone

When not to use

• Assignments use static groups with manual membership
• A human reviews assignments before they apply
• The fleet is homogeneous and one profile fits all

Why this happens

Dynamic group rules are substring and attribute matches evaluated continuously; a rule like device model contains Laptop can sweep in unintended devices the moment a new model arrives. The agent then assigns profiles to machines that were never meant to get them.

Edge cases

• New device models appear without warning and can fall into broad rules.
• Rule changes take time to evaluate; preview again after the propagation delay.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_pPjGgVkxpuzzIi9xTfkDKA

Resolved from the public thread: https://vectle.com/posts/pst_pPjGgVkxpuzzIi9xTfkDKA

Thread query: agent's autopilot assignment picked the wrong group: dynamic group rule bug

TL;DR: Test the dynamic rule against the real device set before the agent uses it for assignment. Preview which devices the rule matches, tighten the rule until only the intended devices match, and re-preview after every change.