Naming Flow - Intune Naming Generator

Platform (What endpoint platform will this apply to?)

Target (What object will this target?)

Type (What broad management area will this apply to?) Examples

Type examples

Type answers: what type of configuration this is. It defines the broad management area before Scope and Purpose make the name more specific.

Type	Description	Typical Location
Account Protection	Use for Windows Hello, LAPS, passwordless, Kerberos, local administrator controls and credential-related protection.	Endpoint security > Account protection
Analytics	Use for endpoint analytics, health monitoring, adoption analytics, usage analytics and reporting-related policies.	Reports > Endpoint analytics
App Control	Use for application control, executable control, script control, managed installer and App Control for Business.	Endpoint security > App Control for Business
App Setting	Use for application settings, application configuration and application-related policy controls.	Apps > App configuration policies / Devices > Configuration
App Protection	Use for app protection policies and Mobile Application Management controls.	Apps > App protection policies
ASR	Use for Attack Surface Reduction rules and related ASR configuration.	Endpoint security > Attack surface reduction
Assignment Filter	Use for Intune assignment filters.	Tenant administration > Filters
Antivirus	Use for Microsoft Defender Antivirus configuration, update channels and Windows Security experience.	Endpoint security > Antivirus
BitLocker	Use for BitLocker and disk encryption policy.	Endpoint security > Disk encryption
Certificate	Use for trusted certificates, root and issuing CA certificates, SCEP, PKCS, device certificates, user certificates and certificate profile objects.	Devices > Configuration
Compliance	Use for device compliance policies.	Devices > Compliance
Conditional Access	Use for Conditional Access policies.	Entra admin center > Protection > Conditional Access
EDR	Use for Endpoint Detection and Response, Defender for Endpoint onboarding and EDR settings.	Endpoint security > Endpoint detection and response
Enrollment	Use for Autopilot, enrolment restrictions, Enrollment Status Page and platform enrolment configuration.	Devices > Enrollment
EPM	Use for Endpoint Privilege Management.	Endpoint security > Endpoint Privilege Management
Firewall	Use for firewall baseline and firewall rule configuration.	Endpoint security > Firewall
Boundary Group	Use for reusable groups that define a logical population boundary such as location, department, role, persona, ownership, vendor status or device class, and may be assigned to multiple management objects.	Entra admin center > Groups
Licence	Use for licence assignment.	Microsoft 365 admin center / Entra admin center
Network	Use for Wi-Fi, VPN, proxy, DNS, network connectivity and network profile configuration.	Devices > Configuration
RBAC	Use for administrative roles, role assignments and RBAC configuration.	Tenant administration > Roles
Script	Use for platform scripts, remediation scripts, detection scripts and custom compliance scripts.	Devices > Scripts and remediations / Devices > Compliance
Security	Use for general security controls when no more specific security Type applies.	Devices > Configuration
Update	Use for update rings, driver updates, feature updates, quality updates and expedited updates.	Devices > Windows updates
User Experience	Use for Start menu, lock screen, privacy, desktop experience, Windows consumer features and user experience settings.	Devices > Configuration

Scope (What is the intended audience or assignment boundary?) Examples

Scope examples

Scope answers: who, what or where is this for? It is the boundary the object applies to.

Scope type	Examples	When to use
All users/devices	All	All refers to all users if the User target is selected, or all devices if the Device target is selected.
Audience / role	AdminDeveloperITSupportFinanceHRExecutiveContractor	When the object targets a user role, department or support function.
Device scenario	AutopilotSharedKioskCorporatePersonalBYODCloudPCAVD	When the object applies to a specific device ownership or build scenario.
Location / region	London OfficeManchester OfficeUKEMEAOffshoreMiddleEastAustralia	When the object is location-specific.

Converted to PascalCase and spaces removed.

Purpose (What is the specific function or intention?) Examples

Converted to PascalCase and spaces removed.

Stage (What is the stage of this management object?)

Version

Version applies to the category name only. Group names, scope tags and group tags do not include version.

Management Object

Groups

Type Group Name

Type Exclusion Group Name

Scope Tag Name

Scope Group Name

Vendor

Application

Version

Architecture

Language

Package Type

Release

Two digits, zero padded, for example 01, 02, 10.

Deployment

Platform (What platform will this application group apply to?)

Target (What object will this target?)

Scope (What is the intended audience or assignment boundary?) Examples

Scope examples

Scope answers: who, what or where is this for? It is the boundary the object applies to.

Scope type	Examples	When to use
All users/devices	All	All refers to all users if the User target is selected, or all devices if the Device target is selected.
Audience / role	AdminDeveloperITSupportFinanceHRExecutiveContractor	When the object targets a user role, department or support function.
Device scenario	AutopilotSharedKioskCorporatePersonalBYODCloudPCAVD	When the object applies to a specific device ownership or build scenario.
Location / region	London OfficeManchester OfficeUKEMEAOffshoreMiddleEastAustralia	When the object is location-specific.

Converted to PascalCase and spaces removed.

Stage (Is this group for testing purposes, or production?)

Application Package

Groups

Application Deployment Group Name

Assignment Details