Intune Assignment and Filter Evaluator
Check whether a user and device receive an Intune app or policy. Enter group assignments with include or exclude mode, app intents and assignment filters, then the user's groups, the device's groups and its properties. The evaluator applies Microsoft's documented group, filter and intent-conflict rules and shows each step.
Run Intune Assignments
Inputs stay in this browser and results are not saved.
What this is: Group, filter and intent rules follow Microsoft's Intune documentation, and the filter parser accepts a tested subset of the rule syntax. Group membership and device properties are what you enter; Intune evaluates live inventory at check-in.
Resulting intent: Required and Available.
- Intent conflict: Microsoft notes that the assignment filter might not work as expected when intents conflict, because intent is evaluated before the filter. Avoid assigning one app with conflicting intents.
Step by step
- Include All users (user group)Targeted
Targeted through All users as Available; no filter.
- Include Finance (user group)Targeted
Targeted through Finance: the device matches the include-mode filter.
(device.deviceOwnership -eq "Corporate") -and (device.operatingSystemVersion -ge "10.0.22631") - Exclude Executives (user group)Not a member
Not a member of Executives, so this exclusion doesn't apply.
Documented rules this model applies
- • Exclusion overrides inclusion only between groups of the same type: user with user, device with device.
- • Intune doesn't evaluate user-to-device group relationships, so a user-group exclusion doesn't remove a device-group assignment, or the reverse.
- • Include filter mode: only matching devices get the assignment. Exclude filter mode: matching devices don't.
- • Filters are evaluated against the device's properties, case-insensitively.
- • A single group can't be targeted with more than one app intent.
- • Different intents from different groups resolve using Microsoft's conflict table; with a conflict, filters might not work as expected because intent is evaluated before the filter.
Sources (checked 9 Nov 2026) · model v2026.11.1
Who this Lab is for
Designed for
- Microsoft Intune administrators
- Endpoint engineers managing Windows, macOS and mobile fleets
- Service desk analysts investigating why an app or policy didn't arrive
Use it when
- An app or policy didn't install, or installed where it shouldn't have
- Writing an assignment filter and testing it against a device's properties
- Mixing user and device groups, or assigning one app with different intents
A complete run, step by step
Choose app or policy
Apps take an intent per included group (required, available or uninstall). Policies are simply assigned.
Add assignment rows
Add user or device groups, including the built-in All users and All devices, in include or exclude mode. Add a filter rule and mode to included rows where you use one.
Describe the user and device
List the user's groups and the device's groups, and the device properties your filters reference, such as deviceOwnership or operatingSystemVersion.
Read the trace and confirm
Check each row's outcome and any warnings, then confirm the device's assignment status in the Intune admin center.
What you will need
Prepare the following information before starting. Use measured evidence where possible; defaults are examples and should not be treated as recommendations.
Assignments
Up to 20 rows: a user or device group (including the built-in All users and All devices), include or exclude, the app intent (required, available or uninstall) and an optional assignment filter rule with its mode.
Assignment filter rule
Intune rule syntax such as (device.deviceOwnership -eq "Corporate") -and (device.operatingSystemVersion -ge 10.0.22631). Supports -eq, -ne, -startsWith, -contains, -notContains, -in, -notIn, version comparisons on operatingSystemVersion, and parentheses.
User and device
The user's groups, the device's groups and the device properties the filters read, such as manufacturer, model, deviceOwnership, operatingSystemVersion, operatingSystemSKU and enrollmentProfileName.
What the result tells you
Your report includes
- Whether the assignment reaches this user and device, and the resulting intent for apps
- Each row's outcome: not a member, excluded by group, filtered out, targeted, or an exclusion that has no effect
- The parsed filter in canonical form and whether the device matched
- Warnings for mixed-type exclusions and intent conflicts
Notes on how this lab calculates its results
Pure TypeScript. Exclusion overrides inclusion between groups of the same type; Intune doesn't evaluate user-to-device group relationships, so a mixed-type exclusion has no effect. Include-mode filters deliver only to matching devices and exclude-mode filters to non-matching devices. App intent conflicts resolve from Microsoft's table; Microsoft notes that with a conflict, filters might not work as expected because intent is evaluated before the filter. The filter parser accepts a tested subset of the documented syntax: device or app properties; -eq, -ne, -startsWith, -contains, -notContains, -in, -notIn; -gt, -ge, -lt, -le on operatingSystemVersion; $null with -eq and -ne; and/or with parentheses. Sources: Microsoft Learn pages on assignment filters, filter properties and operators, include and exclude app assignments, app intent conflicts and policy assignment, checked 9 Nov 2026.
Group, filter and intent rules follow Microsoft's Intune documentation, and the filter parser accepts a tested subset of the rule syntax. Group membership and device properties are what you enter; Intune evaluates live inventory at check-in.
Model assumptions
- • And/or can't be mixed at one level without parentheses, because Microsoft doesn't document their precedence.
- • operatingSystemVersion is compared as dotted numbers, with missing trailing parts treated as 0. This is the model's interpretation.
- • Comparisons on a property with no value are refused unless they test for $null, because Microsoft doesn't document that case.
- • Intent combinations that aren't in Microsoft's conflict table are reported as undocumented rather than guessed.
Authoritative references
Available to everyone, required for Finance on corporate devices
Situation
An app is Available to All users and Required for the Finance user group with an include filter (device.deviceOwnership -eq "Corporate") -and (device.operatingSystemVersion -ge 10.0.22631). Executives are excluded. A Finance user's corporate device runs 10.0.26100.2314.
Result
The filter matches, so both rows target the device and the intents resolve to Required and Available. The evaluator warns that Microsoft says filters may not behave as expected when intents conflict.
Use the result with engineering judgement
- Group membership and device properties are what you enter. Intune evaluates live inventory and group membership, including dynamic group processing delays.
- And/or can't be mixed at one level without parentheses, because Microsoft doesn't document their precedence.
- Version comparison treats missing trailing parts as 0; this is the model's interpretation.
- Intent combinations missing from Microsoft's table, and three or more intents at once, are reported as undocumented.
- Setting conflicts between policies, applicability rules, scope tags and platform support aren't modelled.
Questions before you begin
Why doesn't my device-group exclusion remove a user-group assignment?
Microsoft documents that Intune doesn't evaluate user-to-device group relationships. Exclusions only take precedence over inclusions of the same group type.
Can I mix -and and -or?
Yes in Intune, but Microsoft doesn't document the precedence, so this parser asks you to add parentheses. The result is unambiguous and matches what you meant.
Which properties can I use?
Any property name, so you can test the ones Microsoft lists, such as manufacturer, model, deviceOwnership, operatingSystemVersion, operatingSystemSKU, enrollmentProfileName and deviceCategory. Version operators are limited to operatingSystemVersion, as documented.
Is anything sent to Intune?
No. The tool runs in your browser and doesn't connect to any tenant.
Ready to run Intune Assignments?
Open the interactive utility without an account. Inputs and results are not saved.
Open toolGet practical engineering references
A short email about twice a week with new runbooks, configuration traps and fixes from KBY Technologies.
Continue from this result
Turn the calculation into an engineering decision
Carry the assignment design into Intune with filters you have tested and groups that don't conflict.
Read the engineering context
Search all contentMobile Application Management for BYOD: MAM Without Enrolment
Use Microsoft Intune mobile application management and app protection policies to protect work data on BYOD devices without requiring full device enrolment.
Surviving the Final Domain Controller Cutover
Retiring the last on-prem DC exposes hardcoded LDAP binds, NTLM handshakes, and RADIUS dependencies that Entra ID cloud-only cutover plans routinely miss.