Microsoft Entra administrative units support dynamic device membership based on device attributes. AU1 uses the following membership rule:
(device.deviceTrustType -eq " Workplace " ) -and
(device.deviceOSType -in [ " Windows " , " Android " ])
Statement 1: No.
Admin1 holds the Global Administrator role. However, AU1 uses dynamic membership, which prevents administrators from manually adding or removing members. Membership is determined exclusively by the configured rule.
Additionally, Device1 is Microsoft Entra joined, corresponding to deviceTrustType = AzureAD, rather than Workplace. Therefore, Device1 does not satisfy the rule.
Statement 2: Yes.
Device2 runs Windows 11 and is Microsoft Entra registered.
Microsoft Entra registered devices have a deviceTrustType value of Workplace, and Windows matches the permitted operating system list. Therefore, Device2 satisfies both conditions and is automatically included in AU1.
Statement 3: Yes.
The planned Android devices must be Microsoft Entra registered. Registered Android devices satisfy the Workplace trust condition and, when their recorded operating system value is Android, also satisfy the OS condition.
Consequently, they are automatically added to AU1 through dynamic membership processing. Group1 membership itself does not determine AU1 membership.
Administrators should verify the actual deviceOSType value because some Android Enterprise registrations use more specific operating system identifiers.
Microsoft References:
Submit