Confusion Regarding Filter Precedence

App Deployment/Packaging

Here’s the scenario I’m facing (VPP app):

Group A (Required Assignment):

  • Users: Identical to Group B.

  • Filter: Include only corporate iPhones.

  • Purpose: Auto-install the app on corporate-owned iPhones.

Group B (Available Assignment):

  • Users: Identical to Group A.

  • Filter: None.

  • Purpose: Make the app available to all devices (corporate and BYOD) in the Company Portal.


  • BYOD devices are receiving the required install despite the filter.

  • Filter message: “The app was offered during the last check-in. We couldn’t evaluate the device for matching filters because a conflicting assignment didn’t require filters.”

    • Filter: (device.model -contains “iPhone”) and (device.deviceOwnership -eq “Corporate”)

    • Evaluation result: Not evaluated due to a conflicting assignment without filters.

Business Request:

  • The app should be available to the same list of users.

  • It should be required (auto-installed) only on corporate devices.

  • Overlapping groups are used to simplify automation and avoid complicating the process for the Service Desk, which would need to check if devices are BYOD or corporate-owned.

I’ve been looking at:

Filter reports and troubleshooting in Microsoft Intune | Microsoft Learn

Filter reports and troubleshooting in Microsoft Intune | Microsoft Learn

Assign apps to groups in Microsoft Intune | Microsoft Learn

And am admittedly a little smooth-brained. Can anyone explain what’s happening here and how to resolve? Is the “no filter” available group taking precedence over the “include” filter and somehow pushing to all devices?

How can I rectify this? Can I just add a dynamic group to exclude all BYOD devices in the required assignment and leave the rest the same or use an exclude filter for BYOD device in the required assignment? Any help is appreciated.

Similar Posts

Leave a Reply

Your email address will not be published. Required fields are marked *