Intune and Entra group naming convention

Why groups need it most

Every policy, app and script in Intune ends up assigned to a group, and the group picker shows you nothing but names. If a name does not say what is inside, the only way to find out is to open the group. With a few hundred groups, that is where the time goes.

A group name should answer three things: what kind of members, which ones, and how they got there.

What Microsoft enforces, and what it does not

That policy does not cover the security groups you assign Intune policies to. For those, the convention is yours to define and to keep.

256 is the ceiling, not a target. Pickers and list columns cut long names off, so the part that tells groups apart should come early.

Device groups

The membership type matters more than it looks. A dynamic group fills itself, an assigned one is somebody’s job, and knowing which is which saves you from trying to add a device by hand to a group that only takes members by rule.

Open this pattern in the builder

App assignment groups

One group per app and install intent: Required, Available, Uninstall. The names then sort by app, with the three intents next to each other.

Open this pattern in the builder

Department and user groups

Use the department codes the rest of the company already uses, so the name means something outside IT. The purpose says what the members have in common: a licence, a role, a location.

Open this pattern in the builder

Rules that keep groups findable

• Start with what you filter by. If you search for all app groups, APP has to come first.
• Do not name a group after one policy. Groups outlive policies. Name the members, not the thing you assign to them today.
• Name exclusion groups as such. A group used only to exclude devices should say so, or someone will assign a policy to it.
• No spaces. Names without spaces survive scripts, exports and command lines without quoting.

For policies and profiles, see the Intune naming convention guide.