Intune config profile deployment company wide - use "ALL USERS" group or not

@David Moon, Thanks for posting in Q&A. In Fact, to deploy Intune policy, Microsoft Intune license is needed for the user.

Meanwhile, if you want to assign policy to all users, you can just use the All users group.

https://learn.microsoft.com/en-us/mem/intune/configuration/device-profile-assign#assign-a-policy-to-users-or-groups

But if you want to just assign to some users, you can check if any property of the user in the following link can be used to create dynamic group to meet your requirement.

https://learn.microsoft.com/en-us/entra/identity/users/groups-dynamic-membership#properties-of-type-string

For the scenario you want to only apply the policy to some specific devices of the users, you can consider use Intune Filter.

https://learn.microsoft.com/en-us/mem/intune/fundamentals/filters-device-properties

Hope the above information can help.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

@David Moon here is good article to read on filtering and the use of the built in groups.

https://techcommunity.microsoft.com/t5/intune-customer-success/intune-grouping-targeting-and-filtering-recommendations-for-best/ba-p/2983058