When assigning profiles via groups there are times where it is necessary to exclude a profile at a device level while still keeping that device in the group that the profile is assigned by.

Currently it is not possible to do this - the only option at a device level is to assign a profile directly to it.
It is also not always feasible to keep splitting groups out into new "inclusive/exclusive" type group rules.

Example: a group for a specific organisational structure (finance staff) that has a mix of desktops and a small number of laptops might have a profile that really only needs to apply to desktops, so an admin may want to exclude that specific profile from a device at the device level.

Please update the profile assignments at a device level to:
1. Include the 'Assigned Via' information (where relevant)
2. Where a profile is assigned via a group (static or dynamic), display an Exclude button (currently all profiles assigned via a group can still be assigned at the device level, which seems like it should not be possible to do)

Attached is a proof of concept (excuse the potato quality 'Assigned Via' listing; it's a copy pasta).