Windows Autopilot Integration

Overview

Windows Autopilot is Microsoft's deployment program that uses a collection of technologies to fast setup and pre-configure new devices. In general, it is similar to Apple's Device Enrollment Program or the Knox Mobile Enrollment or Android Zero Touch for Samsung Knox and Android devices. Windows Autopilot simplifies the complete lifecycle of the device and users will be able to easily enroll devices from the out-of-the-box experience without any interaction of the IT department. Your users only need to connect to an internet connection, and they need to know their user credentials and can enroll the device to a within a few steps.

To achieve this scenario technically, devices or device identifiers will be added to a cloud service and when devices or users are starting with the out-of-the-box experience, internet connected devices will contact the cloud service to retrieve specific configurations within a profile. To add devices to the cloud service, you have different options and the first one is to contact your hardware vendor as they might be capable to add devices after purchasing them into the Windows Autopilot deployment program for you. Another option is to add devices manually to Windows Autopilot.

The Windows Autopilot Integration offers the option to sync, create, delete and edit Autopilot devices and profiles. For devices from the Autopilot device pool, computer objects are automatically created in Unified Endpoint Management and are thus also available as assets (Asset Management) in your company before they are connected to a system. 

After the device enrollment with your target management system (e.g. Silverback), configurations can be applied to transform the device into an enterprise ready and secured device, e.g. with deploying and installing the UEM Agent to install Software Packages on top. Additionally, you can easily deploy the EgoSecure Data Protection agent for an additional security layer. 

Requirements

• We recommend to review first the following article: Windows 10/11 All about Windows Autopilot
• Installed and configured Windows Autopilot Extension
• Installed and configured Azure Active Directory / Office 365 Data Provider for assigning Groups to Profiles
• Access to Unified Endpoint Management
• For Autopilot enrollments via Silverback, successfully accomplished the configuration for Silverback: 
  • Azure AD Integration I: Configure Azure Active Directory
  • Azure AD Integration II: Configure Silverback

Introduction

After you have installed and configured the Windows Autopilot Extension and an initial synchronization has been successful, you can proceed with this article that gives you an overview of the overall Autopilot integration into the Unified User Experience. First, after the installation, you will find new menu items for the Windows Autopilot integration in the navigation under the Operating Systems section. The menu items include the Windows Autopilot landing page as well as Devices and Profiles, two additional sub-items. 

The landing page shows you four different areas, which are separated into Quick Starts, Statistics, Devices by Service Connection and Devices by Manufactuer and Model. The Quick Starts section includes actions that are performed around Windows Autopilot, such as performing a manual synchronization, adding new devices or profiles, and creating a group for Autopilot devices. The Statistics section shows a total number of available devices and profiles. The other two charts show the number of devices per service connection and the number of devices by manufacturer and model.

Dynamic Autopilot Device Groups

Starting from the Quick Starts panel, you will find a button that is called Create Default Group. Since it is not possible to assign profiles directly to devices via Microsoft Intune or via the Graph API, a small detour via assigning profiles to groups and assigning devices to these groups is necessary. For this we added a simple mechanism to create a dynamic device security group for all Autopilot devices. To create this dynamic group, proceed with the following: 

• From the Quick Starts press Create Default Group
• Select first your Service Connection. By default the first entry from the Windows Autopilot Data Provider is selected. 
  • To select another Service Connection, press the search icon and select your desired Service Connection
  • Ensure that the selected Service Connection has the Group.Create API Permission
• Now enter a Group Name like All Windows Autopilot Devices
• Enter a description, e.g. Dynamic device security group created via UUX that will contain all Windows Autopilot Devices (optional)
• By default, the Dynamic membership rule is set to the following and will include all Autopilot devices

(device.devicePhysicalIds -any _ -contains "[ZTDid]")

• You can modify the rule, e.g. to create a group that includes all Autopilot devices with a specific group tag

(device.devicePhysicalIds -any (_ -eq "[OrderID]:179887111881"))

• Another option is to create a rule that includes all your Autopilot devices with a specific Purchase Order ID

(device.devicePhysicalIds -any (_ -eq "[PurchaseOrderId]:76222342342"))

• Press Create Default Group
• After pressing Create Default Group, the Windows Autopilot - Create Autopilot Default Group Workflow will be initiated immediately
  • Review the Workflow Execution from the Administration application under Services & Processes > Workflow Studio > Workflow Instances.
• During the execution of the Workflow, the Group will be created via an API Call to Microsoft Graph
  • Please note that the Dynamic rule processing at Azure might take some time
  • You can review the processing status from the Group overview in Azure (e.g., Not started or Succeeded)
• To use this group to assign Windows Autopilot Profiles later on, the Azure Active Directory / Office 365 Data Provider must have imported the Group
  • To speed up the process, navigate to the Administration application and activate the Data Provider to initialize an import of your recently created group(s)

Windows Autopilot Profiles

Autopilot deployment profiles are used to configure the deployment method and to customize the out-of-box experience for your users.  You can create up to 350 profiles per tenant and profiles are need to be assigned to a group to address the settings for the devices included there. According to the supported features with Silverback, the values for deployment options are set by default to the supported methods. 

Windows Autopilot Devices

In general, multiple processes are available for adding devices to Windows Autopilot. You can either let your hardware vendor upload your new devices or you can add existing devices manually to Windows Autopilot. Microsoft offers several platforms for device registrations for new devices to Windows Autopilot and in case you have the hardware Id of the device in a *.csv file, you can upload the file via Unified Endpoint Management. The Devices section shows the overview of all registered Autopilot devices with the option to add and remove your devices manually. Every Windows Autopilot devices becomes an Computer Object and will become a part in the Asset Management.

Sync with Autopilot

Additional Notes

• Learn how to easy integrate and Distribute Agents to enrolled devices via Windows Autopilot