How to use Windows Autopilot from Microsoft Store for Business(WMfB) – Mobile-First Cloud-First

maximios June 28, 2022

Microsoft has released information on Windows Autopilot – it is the automation process that was missing when we do cloud only management of Windows 10 devices with Azure Active Directory and Intune.

Some of the benefits of Windows AutoPilot are:

Intune can push policies, settings, and configuration to the device, and install Office 365 and other apps without IT ever having to touch the device or apply a custom image to the device.
Intune can configure Windows Update for Business to apply the latest updates.
The device can automatically upgrade from Windows 10 Pro to Windows 10
Enterprise seamlessly using AAD – no product keys to manage, no reboots, no prompts for the user.(Requires a Windows 10 Enterprise E3 subscription)

New capabilities to Windows AutoPilot that will be added in the Windows 10 Fall Creators Update release later this year include:

Self-service deployment for Active Directory domain-joined devices – Windows AutoPilot Deployment will enable self-service deployment capabilities to get new Windows 10 devices into an Active Directory domain-joined state along with Microsoft Intune enrollment.
Enhanced personalization for self-service deployment – Windows AutoPilot will offer the ability to pre-assign a new Windows 10 device to a specific user in your organization and deliver a highly-personalized OOBE.
Windows AutoPilot Reset – A new reset capability In Windows AutoPilot will enable organizations to easily reset their configured devices while still maintaining MDM enrollment and the Azure AD join state, and automatically get the device back into a business-ready state.

Windows Autopilot has some prerequisites:

Devices must be registered to the organization
Devices have to be pre-installed with Windows 10, version 1703 or later
Devices must have access to the internet
Azure AD premium P1 or P2
Microsoft Intune or other MDM services to manage your devices

Devices must be registered to the organization

We need a csv file to import into the Microsoft Partner Center file must contain:

Device Serial Number,Windows Product ID,Hardware Hash

Getting the serial number run this WMI query

wmic bios get serialnumber

Getting the Windows Product ID run this Powershell command

Get-ItemPropertyValue “hklm:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\DefaultProductKey\” “ProductId”

Getting the Hardware Hash run this WMI query

$wmi = Get-WMIObject -Namespace root/cimv2/mdm/dmmap -Class MDM_DevDetail_Ext01 -Filter “InstanceID=’Ext’ AND ParentID=’./DevDetail’”
$wmi.DeviceHardwareData | Out-File “$($env:COMPUTERNAME).txt”

Then you get a import.csv that look like this:

Device Serial Number,Windows Product ID,Hardware Hash
R9-ZNP67,00329-00000-0003-AA606,T0FzAQEAHAAAAAoA6AOCOgEABgBgW7EdzorHH3g

You can also use Michael Niehaus script from GitHub Get-WindowsAutoPilotInfo 1.0

Devices have to be pre-installed with Windows 10, version 1703 or later

It is working with a clean install of Windows 10 version 1703 as well.

Devices must have access to the internet

With ethernet connected it will skip this part of the OOBE

With wireless – you need to connect to the wireless network

Azure AD premium P1 or P2

Is needed to automatic get the device MDM enrolled as part of the AzureAD joining process.

Microsoft Intune or other MDM services to manage your devices

To manage, configure and deploy application to the device when it is AzureAD joined.

How does Windows Autopilot work:

The overall process looks like this

First you have to sign in to the WSfB

Click on Manage and then Devices

To import one or more devices click on Add devices

Find you file with the unik hardware information and click open

Give the AutoPilot deployment group a name

Click add

The message in top of the view is stating that your request is being processed in the background

Note: The upload can take som time.

To create a AutoPilot deployment profile

Click Create new profile

Enter a name for your AutoPilot deployment profile
Select “Skip privacy settings in setup”
Select “Disable local admin account in setup” – if you don’t what the user to be a local admin
Click create

The

Your new profile is created

The you just need to assign the profile to the devices you just imported.

The message in top of the view is stating that your request is being processed in the background

Note: The upload can take som time.

Now the user of the device will be prompted to login to the AzureAD tenant as part of the OOBE.

Who it the user experience of Windows Autopilot

This is first screen that the end-user has to select the region

Then the keyboard layout

Second keyboard layout

Accept the license agreement

Then Windows will look for network connectivity – if no ethernet is found the end-user will be prompted for wireless settings.

Importen: At this moment the device needs internet connectivity

When network connectivity is established Windows will connect to AzureAD to see if it is a “known” devices

The end-user needs to sign-in with the AzureAD account

Note : If you don’t have configured the company branding page in AzureAD – then this page will not be branded with your tenant name.

Enter the password

When AzureAD joined and automatic MDM enrollemnt is in-place the MDM tool will take over the management of the devices and push down the CSP settings and applications that are assigned to the device.

And then Windows will do a auto login with the user – and the end-user is ready to work.

Non of this process require that the user is in the company internal network.