How to automatically tag Microsoft Entra ID devices based on security state or ownership. Automatically tagging Microsoft Entra ID devices is important. Let's walk through how to classify devices by ownership and security state so you can enforce access, improve reporting, and automate policy decisions. Before we begin, be sure to subscribe to NinjaOne's IT Video Hub and our YouTube channel for more tech content like this. Why automated device tagging matters. Microsoft Entra ID, formerly Azure AD, is now the backbone for hybrid and cloud-native endpoint identity. As environments scale, manual device classification becomes unreliable. Automated tagging creates consistent signals that conditional access, Intune, and security tools can trust. These tags help separate corporate devices from BYOD, identify risky endpoints, and drive lifecycle automation across single-tenant and MSP environments. Using dynamic groups for built-in attributes. First, dynamic device groups provide a baseline tagging method. These groups evaluate device attributes in real time, such as ownership, operating system, trust type, and compliance state. For example, you can automatically group company-owned and compliant devices using a simple rule. Next, those groups can be reused to assign policies, monitor posture, and scope reports without manual updates. Tagging devices with Microsoft Graph. Next, Microsoft Graph enables deeper automation when native attributes are not enough. With Graph, you can query Intune-managed devices by compliance or risk state and write custom extension attributes back to the Entra device object. After that, those attributes become usable for reporting, automation workflows, or conditional access targeting. This approach works well for non-compliant or high-risk device identification. Registry and Group Policy tagging. Meanwhile, registry-based tags offer flexibility for organization-specific classifications. PowerShell scripts can write ownership or security labels locally, which Intune can later evaluate through proactive remediation or custom compliance. In hybrid environments, Group Policy can enforce these registry tags at scale, ensuring consistent labeling before devices are fully cloud-managed. This approach is especially useful for hybrid or partially managed Windows environments. Enforcing access with tags. Finally, tagging becomes actionable through conditional access and Intune filters. Corporate devices can be required to meet stricter baselines while personal devices receive limited access. Microsoft Defender for Endpoint risk signals can also drive remediation when tags indicate elevated risk. Tools like NinjaOne extend this model by standardizing registry tagging, reporting on tag state, and automating responses across tenants. For more information, check out our official blog post on how to automatically tag Microsoft Entra ID devices based on security state or ownership, linked in the description below.