There are three device enrollments available for iOS devices. They are DEP(Device Enrollment Program), Apple Configurator and Corporate Identifier.
For DEP and Apple configurator enrolled devices can be easily fetched using Azure AD Dynamic group using DeviceEnrollmentProfileName property but for corporate identifier devices cannot be done the same way as DEP and Apple Configurator.
Here in this article, I would like to show you this can be achived
(device.deviceManufacturer -eq "Apple") and (device.deviceOwnership -eq "Company") and (device.enrollmentProfileName -notContains "DEP Profile Name") and (device.enrollmentProfileName -notContains "Apple Configurator Profile Name")Basically, what i am doing here is, isolating corporte identifier devices by excluding DEP and Apple configurator profiles. Corporte identifier does not have an enrollment profile creation options so we can only fetch the device using the above query.
Ref: https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/groups-dynamic-membership
