I can see there's a big list of device attributes that can be used when creating dynamic groups... but alas, "DEP Assigned" isn't one I can use.

I trust Apple Business Manager more than I trust my internal asset management system (sad but true) and would like to be able to assign profiles/apps/things only to devices I know are corporate assets.

My primary use case is assigning an Okta device trust certificate... but I'm sure I'll find more...

At a pinch I could use "DEP Enrolled" but a lot of our "DEP Assigned" devices have been manually enrolled... so it doesn't really work for this use case.

Thanks!