Group Automations (Preview)

Group Automations keeps a Microsoft Entra ID device group in sync with the devices that have a given app installed. Membership is refreshed once a day from BI for Intune, so you can target an app update or ring deployment at just the devices that need it instead of targeting everyone.

Preview feature

Group Automations is a preview feature. Preview features are made available so you can try them and give us feedback. They may be incomplete, can change before general availability, and are provided without a service level agreement or production-level support. A preview feature may also be withdrawn before general availability if it does not meet our quality and performance expectations. Some behavior may not be fully supported. We do not recommend depending on a preview feature for critical production workloads. Test it in a limited scope first, and tell us how it performs in your environment.

Best practice: reuse a group for update deployments

Point an App Update or ring deployment at the Entra device group an automation manages. Only the devices that actually have the app receive the update, and the membership stays current without manual edits.

Connecting BI for Intune

Group Automations reads installed-app data from your BI for Intune semantic model. The App Store connects to it as its managed identity (no secret) and runs read-only queries.

Under Settings, in the BI for Intune connection section, provide the Power BI workspace ID and semantic model (dataset) ID, then select Test connection to confirm access before you create an automation.

Requirements

• BI for Intune with populated app inventory on a Power BI Pro (or higher) workspace.
• The App Store managed identity added to that workspace with Build permission.
• The Power BI tenant settings Service principals can use Fabric APIs and Semantic Model Execute Queries REST API enabled for the App Store managed identity. A Fabric (Power BI) administrator sets these once in the Power BI admin portal, scoped to the whole organization or to a Microsoft Entra ID security group that contains the managed identity.

Note

Tenant-setting changes can take up to 15 minutes to take effect.

Caution

The App Store managed identity also needs the Microsoft Graph Device.Read.All (or Directory.Read.All) application permission. Membership sync matches a device in BI for Intune, then resolves it to its Entra ID device object before adding it to the group. Without this permission, a run reports matched devices but adds none.

Creating an automation

Go to Automations > Group Automations and select New automation. Then define:

• Name: a name for the automation, and an optional description.
• Target Entra group: create a new device security group, or select an existing one. The group name is required. The App Store manages the group’s membership, so avoid editing it by hand.
• Membership rule: include a device when its installed apps match all or any of a set of conditions. Each condition is on Application name, Publisher, or Version.
• Options: remove devices that no longer match, notify on membership changes, and enable or disable the automation.

Select Preview matching devices to see how many devices match, listed by device name, before you save.

Automation limit

A tenant can have up to 25 group automations. When you reach the limit, the New automation button is disabled; remove an existing automation to create another.

Matching apps that put the version in the name

For an app such as Oracle Java that includes its version in the display name, match the product line with Application name starts with and compare separately on Version.

How the daily run works

All enabled automations reconcile once a day, tenant-wide, one automation at a time (up to 25 automations per tenant).

The daily schedule is opt-in. Turn on Run automations on a daily schedule under Settings, in the BI for Intune connection, to enable it. Until it is on, an automation runs only when you select Run now. The automations list shows a Daily run on or Daily run off indicator so you can tell at a glance.

Reconciliation adds and removes only the difference between the current group and the matched devices. It never rebuilds the group from scratch. A run that matches zero devices, or that fails to query, is skipped and the group is left intact, so a temporary data problem cannot empty a group.

Membership updates only the group. You still target the update itself from App Management by pointing an App Update or ring deployment at the group.

Notifications

Turn on notifications under Communications for:

• Membership changes.
• Failed or skipped runs.
• Configuration changes.

Notifications are delivered over the email and Teams channels configured on the Communications tab.