Transit wants one targeting object for Android, city-owned, Transportation organization group devices. What should the administrator create?

Transit wants one targeting object for Android, city-owned, Transportation organization group devices. Create a smart group whose criteria are Android, Corporate Dedicated, and the Transportation organization group—a saved search, not a fire hose. Assigning every payload to All Devices and telling Transportation staff which ones to ignore fails by concept because All Devices over-targets and relies on humans to ignore wrong payloads. Building three separate Carbon Black Cloud sensor groups and nesting them in NSX-T fails because CBC/NSX grouping is not the UEM smart-group targeting primitive for apps and profiles. Using a Workspace ONE Access authentication method named Smart Group as the targeting primitive fails because Access auth methods are not UEM assignment groups. Exam caveat: multi-criteria UEM targeting uses smart groups (OS, ownership, OG)—not All Devices, not CBC/NSX nesting, not Access method names. Operational check: create the smart group with Android + Corporate Dedicated + Transportation OG, assign a test profile, confirm only matching devices receive it, and ensure All Devices was not used. Export smart-group criteria into the transit UEM design doc so seasonal Android buys stay correctly scoped.