Michael Niehaus has this covered in his blogpost: Autopilot profile assignment using Intune
The quick guide will be to create a Dynamic group in Azure AD with the following rule syntax:
(device.devicePhysicalIDs -any _ -contains "[ZTDId]")
If you manage more than a handful of Azure subscriptions, IAM hygiene quickly becomes one of those tasks everyone knows is important, but ...