Setup Windows Autopilot and add existing devices

Company Branding
Microsoft Azure - Company Branding

Before Windows Autopilot can be used, Company Branding must be configured. The above link redirects directly to the correct location, make sure to login as a global administrator.

• Create "New Language"
  
• The following settings are required for proper functioning of autopilot.
  1. Background image
     
  2. Banner logo

Azure Device Settings
Microsoft Azure - Device Settings

To allow users to join devices to Azure it is necessary to adjust the devices settings. Use the link above to go directly to the correct location.

1. Users may join devices to Azure AD; select all or a security group. (Requirement)
2. Users who are adding devices from the internet must add a second method of authentication.
   
3. Designates the maximum number of devices a user can have in Azure AD. (Azure device Quota)
4. This is where Local admins can be added; having a license is not necessary.
   
5. For storing the user profile.
   

CNAME Validation
Microsoft endpoint Manager - CNAME Validation

To simplify enrollment, it is necessary to create two (DNS) alias (CNAME records). This ensures that the enrollment requests are redirected to the Intune servers.

• For the full documentation, I refer you to this page from Microsoft. Simplify Windows enrollment
• After you have added the records to your domain, you can check in the endpoint manager console whether these records are actually active. To go directly to this location use the link "CNAME Validation"
  

Automatic MDM Enrollment
Microsoft endpoint Manager - Automatic MDM enrollment

Use MDM auto-enrollment to manage enterprise data on your employees' Windows devices. MDM auto-enrollment will be configured for AAD joined devices and bring your own device scenarios.

1. Mobile Device Management (MDM) Scope for all users or a selective group. (Required)
2. Mobile application management (MAM) Scope for all users or a selective group.

Dynamic Security Group
Microsoft Azure - Dynamic Security Group

Before we start creating an Autopilot profile, we are going to create a Dynamic Security Group. This security group will be autmatically assigned all devices added through autopilot.

1. Create a new security group in Azure (New Group)
   
2. Give it a name and optionally a description.
3. Change the membership type to "dynamic Device"
4. Add Dynamic Query (device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))
   

Enrollment Status Page
Microsoft endpoint Manager - Enrollment Status Page

After the user logs in to the device he will see the enrollment status page. Depending on the selected option, the user will have the possibility to use the device before everything is finished. It is also possible to block the device until certain applications are installed, for example antivirus or the office suite.

Deployment profiles
Microsoft endpoint Manager - Deployment profiles

Now that all the configuration is done, you can start creating an autopilot profile. Here you can indicate which choices a user is allowed to modify before the device can be used. Also important is that you can specify which rights a user has on the device; User or administrator.

• After creating the profile, you must assign it to the dynamic security group you have created.

PowerShell Add device to Autopilot (CSV)
Follow these steps to add an existing Windows 10 device to Autopilot

Once your new device is installed and you are at the screen where you can select the language, press Shift + F10. If you have never used Autopilot -Online, you will be asked to give permission to use Intune PowerShell; this must be done by a user with domain admin rights.

1. PowerShell
2. New-Item -Type Directory -Path"C:\HWID" (Only needed if you want to do a CSV import)
   
3. Set-Location -Path "C:\HWID" (Only needed if you want to do a CSV import)
4. Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted 
5. Install-Script -Name Get-WindowsAutoPilotInfo
6. Get-WindowsAutoPilotInfo.ps1-OutputFile AutoPilotHWID.csv

PowerShell Add Device to Autopilot (Online)
Follow these steps to add an existing Windows 10 device to Autopilot.

Once your new device is installed and you are at the screen where you can select the language, press Shift + F10. If you have never used Autopilot -Online, you will be asked to give permission to use Intune PowerShell; this must be done by a user with domain admin rights. 

1. PowerShell
   
2. Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted 
3. Install-Script -Name Get-WindowsAutoPilotInfo 
4. Get-WindowsAutoPilotInfo.ps1 -AssignedUser "User UPN Name" -AssignedComputerName "Fixed device name" -Online

PowerShell Add Device to Autopilot (Intune PowerShell)
Follow these steps to add an existing Windows 10 device to Autopilot.

Once your new device is installed and you are at the screen where you can select the language, press Shift + F10. If you have never used Autopilot -Online, you will be asked to give permission to use Intune PowerShell; this must be done by a user with domain admin rights.

1. In the image you can see what the permission looks like.