Automating Intune Deployment Rings Using Entra ID Dynamic Groups and Regex

Recently, I came across an insightful blog post on X (formerly Twitter) by Peter, discussing dynamic group creation for Intune deployments. Inspired by that, I wanted to share my own method—using regular expressions (regex) in Entra ID dynamic groups to build deployment rings based on percentage logic for Intune.

🧩 The Use Case

Imagine managing 3,000 Windows devices across different locations, regions, or countries. You want to stage your Intune deployments in phases—starting with a pilot, then gradually rolling out to production in multiple rings.

Here’s a rollout schedule I prefer (though you can adjust the % as needed):

Ring name	Group Name	% of devices (~)	Count of devices
Pilot	Intune - Dynamic computers - Pilot	5	150
Prod Ring 1	Intune - Dynamic computers - Ring 1	10	300
Prod Ring 2	Intune - Dynamic computers - Ring 2	20	600
Prod Ring 3	Intune - Dynamic computers - Ring 3	25	750
Prod Ring 4	Intune - Dynamic computers - Ring 4	40	1200
Total		100	3000

🧠 How Does This Work?

Device object IDs in Entra ID are 32-character hexadecimal strings, ending with a character from (16 combinations): a, b, c, d, e, f, 0, 1, 2, 3, 4, 5, 6, 7, 8, 9

That’s 16 unique characters, and each one represents roughly 6.25% of all possible values. So if we match devices whose object IDs end in certain characters, we can approximate a percentage-based split.

Approximate Regex Matches by Percentage

%(~)	Regex Suffix	Matches Hex Chars
5%	[0]$ or [f]$	1 Char
0%	[0f]$	2 Char
20%	[0f1]$	3 char
25%	[0f12]$	4 char
40%	[0f1234]$	6 char

🛠️ Example: Dynamic Group RulesHere’s how the regex-based dynamic rules look for each ring:

Ring name	Group Name	% of devices	Count of devices	Query (~ based on hex value)
Pilot	Intune - Dynamic computers - Pilot	5	150	(device.deviceId -match "^.*[0]$")
Prod Ring 1	Intune - Dynamic computers - Ring 1	10	300	(device.deviceId -match "^.*[0f]$")
Prod Ring 2	Intune - Dynamic computers - Ring 2	20	600	(device.deviceId -match "^.*[0f1]$")
Prod Ring 3	Intune - Dynamic computers - Ring 3	25	750	(device.deviceId -match "^.*[0f12]$")
Prod Ring 4	Intune - Dynamic computers - Ring 4	40	1200	(device.deviceId -match "^.*[0f1234]$")
Total		100	3000

🎯 Real-World Filtering Example

Here’s a full dynamic membership rule for Windows 10/11 devices that:

• Start with OS version 10.0.1 or 10.0.2 (windows 10 or Windows 11)
• Are not MDE Managed
• Belong to the ~5% Pilot ring
• you can also add deviceManagementAppId for devices that are SCCM/Intune managed as well https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership

((device.deviceOSVersion -startsWith "10.0.1") 
 -or (device.deviceOSVersion -startsWith "10.0.2"))
 -and (device.deviceOSType -startsWith "Windows")
 -and (device.systemLabels -notContains "MDEManaged")
 -and (device.deviceId -match "^.*[0]$")

🔍 In My Lab

In my test environment with around 170 devices, using the pilot ring rule (deviceId ends in [0]) results in about 10 devices, which is roughly 6% — as expected.

📸 Screenshot below showing filtered devices in pilot ring:

✅ Summary

This regex-based approach is a simple, scalable way to:

• Divide devices into rollout rings
• Avoid manual tagging or static groups
• Work with native Entra ID (Azure AD) features

You can easily adapt this method for 200, 3,000, or even 100,000 devices — and it works seamlessly with Intune, Windows Autopatch, or Feature Update rings.