Prerequisites for synchronizing membershipsīefore we get started, if you have not started your journey to cloud-attaching ConfigMgr to the cloud, or have never heard of Co-management before, read up on the following documentation from Microsoft:Ī prerequisite for synchronizing device collections memberships using this new feature, you need to have configured Cloud Management under Administration – Cloud Services – Azure Services in the ConfigMgr console, meaning you’ve on-boarded your tenant and connected it with ConfigMgr. However, we’re going to focus on device collections for the remainder of this post. It needs to be turned on under Administration – Updates and Servicing – Features as shown below.Īs an extra bonus, we’ve only mentioned this new feature in the context of device collections, but it works for user collections and Azure AD user groups too. When writing this post, this new feature is currently available as a pre-release feature. In this post I’ll show you how to enable the synchronization of a device collection with an Azure AD group.

Simply put, utilize the extensive hardware inventory gathering process of ConfigMgr, create a device collection based out of that information and synchronize the memberships directly to an Azure AD group in the cloud. You may wonder, why is that important? The answer is that you’re now able to have the same targeting capabilities in a Co-management scenario from both ConfigMgr and Intune. With the release of ConfigMgr 1906 we can now synchronize the memberships of a given device collection to a specific Azure AD group. However, being able to group devices more specifically based out of a desired property and value from Intune have not been possible. These days, with cloud attaching your on-premise infrastructure, we gain more functionality with features like with Co-management. In a ConfigMgr world, we’ve always had the pleasure of extending hardware inventory and being able to gather extensive data allowing us to group devices more or less how we want. These groups are limited to a defined set of properties available on the Azure AD device object.

Groups in Azure AD have sometimes proven difficult to fully utilize when it comes to querying a set of devices based out of various specific data.

Aad logs