Assignment Analyzer
Browser-onlyAssignments are easy to get subtly wrong. Describe an app or policy's included and excluded groups and filters, and see the effective audience — and who actually receives it.
Runs entirely in your browser.
The values you enter are processed locally and are never sent to IntuneBench.
You can use this tool offline once the page has loaded.
Include groups
Exclude groups
Provide users and devices with the groups they belong to and the filters they match to see exactly who receives the workload.
How it works
Add the include groups and exclude groups, choose a filter mode for each, and optionally describe some users and devices with the groups they belong to and the filters they match. The tool computes the effective audience and reports who receives the workload and why.
The rules it applies
- Exclusions win. A principal in both an included and an excluded group does not receive the workload.
- Filters narrow a group. An include filter means only matching devices receive it; an exclude filter removes matching devices.
- Scope matters. User groups target users, device groups target devices, and the All users / All devices targets match everything of that kind.
What it flags
- An assignment with no include groups, which reaches nobody.
- A group that is both included and excluded, where the exclusion cancels the inclusion.
- A filter mode set without choosing a filter.
- An excluded group that is not an include group and may have no effect.
Supported scenarios
- Confirming that a new assignment reaches the intended audience.
- Explaining an assignment to a colleague or in a change record.
- Checking whether an exclusion is actually doing anything.
Common problems
- Filters apply to managed devices (enrolled) and managed apps; they are not a substitute for group membership.
- The tool models group membership as data you provide; it does not query your tenant.
- Dynamic group membership is resolved by Microsoft Entra, not here, so enter the resulting membership.