Microsoft recently added the operatingSystemVersion property to assignment filters in Microsoft Intune. That makes this a good time to look at what changed, why it matters, and how assignment filters can help you build faster, cleaner, and more flexible deployments.
What changed?
On August 25, 2026, with Microsoft Intune service release 2608, operatingSystemVersion was introduced as a property for assignment filters. This property replaces the older osVersion property, which is now deprecated.
What does this mean for assignment filters?
You can no longer create new assignment filters that use osVersion. Existing filters that already use osVersion will continue to work, but new filters should use operatingSystemVersion instead.
The ins and outs of assignment filters
What are assignment filters?
Assignment filters were introduced in 2021 and give Intune administrators a powerful way to refine assignments for apps, configuration profiles, compliance policies, and other supported workloads.
Instead of creating many separate groups for every small targeting scenario, assignment filters let you include or exclude devices and apps based on properties such as operating system version, manufacturer, ownership, model, enrollment profile, or device trust type. For example, you can deploy a policy only to corporate-owned Windows devices, target a specific OS version, or exclude personal devices from a configuration.
Key facts:
- Filters return either “true” or “false” for each device or app.
- When the result is true, the associated policy or app assignment applies.
- Multiple rules can be combined by using AND/OR operators.
Assignment filters vs groups
Dynamic groups in Microsoft Entra ID are useful for automatically building user or device membership based on rules. However, group membership evaluation can take time, especially in larger environments or when you depend on many dynamic groups for targeting.
Assignment filters are evaluated during Intune assignment processing, which makes them very useful when you need fast, property-based targeting within an existing audience.
The best approach is usually to use groups for the broad audience and assignment filters to refine which devices or apps within that audience actually receive the policy. You can apply filters in either Include or Exclude mode during assignment for supported workloads.
In short: Groups define the audience. Assignment filters refine the assignment.
Why is this important?
The real benefit of assignment filters is how they reduce complexity while improving targeting precision. Instead of creating and maintaining many separate groups, you can assign a policy to a broader audience and let the filter decide whether the assignment should apply.
What problem do assignment filters solve?
- They help target the right devices without creating dozens of additional groups.
- They allow you to assign a policy to All devices, All users, or a broad group, and then refine the assignment with a filter.
- They can reduce dependency on dynamic group membership updates between Microsoft Entra ID and Intune.
- They make assignment logic easier to reuse across multiple apps, policies, and profiles.
Microsoft has a good Learn article about performance recommendations for grouping, targeting, and filtering in large Microsoft Intune environments. It is worth reading if you are planning your group and filter structure. See the link under useful links.
Examples
You can find assignment filters in the Intune admin center under Tenant administration > Assignment filters.
Basic example:
Filter for Microsoft Entra joined devices:
(device.deviceTrustType -eq "Azure AD joined")This filter returns true for devices where the device trust type is Microsoft Entra joined.
Advanced example with multiple rules
You can also create filters with multiple evaluations. When you need a filter to support more than one scenario, you can combine rules by using and and or operators.
Multiple rules filter example:
(device.deviceName -contains "DEMO") and (device.deviceOwnership -eq "Corporate") or (device.model -eq "Viritual Machine") and (device.enrollmentProfileName -eq "Autopilot Default")
In this example, the filter can match devices based on either of the combined rule sets. This gives you a flexible way to support different deployment scenarios without creating several separate groups.
Tip: Always use the Preview button to validate that your filter returns the expected devices before assigning it to production workloads.
Another useful feature is Associated assignments. Open a filter and select Associated assignments to see where the filter is currently used. This is a simple way to understand which apps, policies, and profiles depend on a specific filter.
My take
Assignment filters are a powerful way to simplify deployment logic and make Intune assignments more flexible.
For many customers, a cleaner model is to use broader assignments, such as All devices or All users, and then use filters to control exactly where policies and apps apply.
With the new operatingSystemVersion property, filters become even more useful for OS-version-based targeting.
If you already use osVersion in existing filters, now is a good time to review them and plan the transition to the new property for future filter rules.
Assignment filters are not a replacement for groups, but when used correctly, they can make your Intune assignments faster, cleaner, and easier to manage.
Useful links
List of platforms, policies, and app types supported by assignment filters
Leave a Reply