Group Automations (Preview)

Group Automations keeps a Microsoft Entra ID device group in sync with the devices that have a given app installed, using data from BI for Intune. When the daily schedule is on, membership is refreshed once a day. The schedule is off by default. With the group kept current, you can target an app update or ring deployment at just the devices that need it instead of targeting everyone.

Preview feature

Group Automations is a preview feature. Preview features are made available so you can try them and give us feedback. They may be incomplete, can change before general availability, and are provided without a service level agreement or production-level support. A preview feature may also be withdrawn before general availability if it does not meet our quality and performance expectations. Some behavior may not be fully supported. We do not recommend depending on a preview feature for critical production workloads. Test it in a limited scope first, and tell us how it performs in your environment.

Best practice: reuse a group for update deployments

Target an app’s update rings at the Entra device group an automation manages. Only the devices that actually have the app receive the update, and the membership stays current without manual edits. See Target updates at the group.

Connecting BI for Intune

Group Automations reads installed-app data from your BI for Intune semantic model. The App Store connects to it as its managed identity (no secret) and runs read-only queries.

Under Store Administration > Integrations, in the BI for Intune connection section, enter the Power BI Workspace ID and Dataset (semantic model) ID, select Save connection, and then select Test connection to confirm access before you create an automation. App Store uses the connection as soon as it’s saved, and Test connection checks the saved connection.

If Test connection fails right after you grant access, for example with “Connection failed: Power BI executeQueries returned 404”, wait for the tenant settings to take effect (up to 15 minutes). If it still fails, stop the App Service and then start it, so it gets a new token for Power BI, and select Test connection again.

Requirements

• BI for Intune with populated app inventory on a Power BI Pro (or higher) workspace.
• The App Store managed identity, which has the same name as the App Store App Service, added to that workspace as a Viewer.
• Build permission on the BI for Intune semantic model for the managed identity, granted through a Microsoft Entra ID security group that contains it. Power BI doesn’t grant a semantic model permission to a managed identity directly.
• The Power BI tenant settings Service principals can use Fabric APIs and Semantic Model Execute Queries REST API enabled for the App Store managed identity. A Fabric (Power BI) administrator sets these once in the Power BI admin portal, scoped to the whole organization or to a Microsoft Entra ID security group that contains the managed identity.

Note

Tenant-setting changes can take up to 15 minutes to take effect.

Caution

The App Store managed identity also needs the Microsoft Graph Device.Read.All application permission, which the setup script grants. Membership sync matches a device in BI for Intune, then resolves it to its Entra ID device object before adding it to the group. Without this permission, a run reports matched devices but adds none.

App Store’s access is separate from BI for Intune’s own. BI for Intune refreshes its data with its own app registration and client secret, as described in App Registration Security. App Store doesn’t use that registration or its secret: it reads the semantic model as its managed identity.

Creating an automation

Go to Automations > Group Automations (Preview) and select New automation. Then define:

• Name: a name for the automation, and an optional description.
• Target Entra group: select Create a new group and enter the new device security group’s name, or select Use an existing group and enter the existing group’s object ID, which you can copy from the group’s Overview in the Microsoft Entra admin center. App Store doesn’t search for the group by name. If you leave the box empty, App Store shows “Enter the existing group object ID.” App Store manages the group’s membership, so avoid editing it by hand.
• Membership rule: include a device when its installed apps match all or any of a set of conditions. Each condition is on Application name, Publisher, or Version.
• Options: remove devices that no longer match, notify on membership changes, and enable or disable the automation.

Before you save, select Preview matching devices. The preview shows how many devices match, and the names of up to five of them as a sample.

Automation limit

A tenant can have up to 25 group automations. When you reach the limit, the New automation button is disabled; remove an existing automation to create another.

Matching apps that put the version in the name

For an app such as Oracle Java that includes its version in the display name, match the product line with Application name starts with and compare separately on Version.

How the daily run works

When the daily schedule is on, all enabled automations reconcile once a day, tenant-wide, one automation at a time (up to 25 automations per tenant).

The daily schedule is off by default. Turn on Run automations on a daily schedule under Store Administration > Integrations, in the BI for Intune connection, to enable it. Until it is on, an automation runs only when you select Run now. The automations list shows a Daily run on or Daily run off indicator so you can tell at a glance.

Reconciliation adds and removes only the difference between the current group and the matched devices. It never rebuilds the group from scratch. A run that matches zero devices reports Skipped, and a run whose query to BI for Intune fails reports Failed. Either way, the group is left intact, so a temporary data problem can’t empty a group.

Removal also needs complete data. If any matched device cannot be looked up in Microsoft Entra ID, or the group’s current members cannot all be read, the run removes nobody and reports Incomplete rather than Success. Members it could confirm are still added. The next complete run removes the members that no longer match.

Target Updates at the Group

An automation updates only the group’s membership. To send an app’s updates to the group:

1. Go to Apps > App Updates and select the app.
2. Under Update Rings, select Configure. If the app already has rings saved, the button reads Edit.
3. Apply a ring template that includes the group, or set up custom rings and add the group to a ring.

Ringless deployment targets only All Devices or All Users, so it can’t target the group.

Notifications

Under Store Administration > Communications, in Group Automation Notifications, choose when to notify:

• When a group’s membership changes.
• When a run fails or is skipped.
• When an automation is created, changed, or deleted.

Notifications go to the App Store administrators and the administrator who created the automation, over the email and Teams channels configured on the Communications page.