Microsoft Intune - AutoPilot - How to Create and Test an AutoPilot Deployment for Dell Provisioning

1. Configure the Group Tag (OrderID) for the Azure dynamic device group used to target Windows Autopilot devices.

   1. Existing device group: Submit an EIT Request Help ticket and provide the required Group Tag (OrderID) values. Use the example dynamic membership rule below as a reference.

   2. New device group: Submit a Request Intune Dynamic Device Group request and provide the required Group Tag (OrderID) values. Use the example dynamic membership rule below as a reference

Example Dynamic Membership Rule: 
(device.displayName -startsWith "XXX") and (device.deviceManagementAppId -contains "0000" or device.deviceManagementAppId -contains "54b9") and (device.deviceOSType -eq "Windows") or (device.devicePhysicalIds -any (_ -eq "[OrderID]:TAG1") or (_ -eq "[OrderID]:TAG2")) 

Important: Replace the sample TAG values in the dynamic membership rule with the Group Tag (OrderID) values required for your environment. Add or remove Group Tag values as needed. These values must match the tags assigned during the Windows Autopilot import process.

1. Create a new Windows Autopilot deployment profile or use an existing deployment profile.
2. Assign the Azure dynamic device group configured in the previous step to the Windows Autopilot deployment profile.
3. Confirm the Autopilot deployment profile assignment is successful and that the target group contains the correct Group Tag (OrderID) values.

1. Create the required Intune applications using the Intune app deployment wizard. If the application is provided as an MSI, follow the procedure below to create a Win32 app package.
   Important:
   - Do not mix Windows MSI Line of business and Win32 app as this will break Autopilot. 
   - UWP applications are not recommended for Enrollment Status Page (ESP) deployments due to inconsistent installation behavior.
   - Application installers must suppress restart prompts. Restart requirements during provisioning can interrupt the Autopilot process.
   - Microsoft Store apps and Win32 applications can be deployed together.
2. If an application is provided as an MSI, create a Win32 package using the Microsoft Win32 Content Prep Tool.
   1. Prep: Download the Intune Win32 App Packaging Tool 
      1. Go to Microsoft’s GitHub: https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool 
      2. Download this file IntuneWinAppUtil.exe. 
      3. Extract it to a folder, for example: C:\Intune\Win32. 
   2. Create the .intunewin File (Wrap the MSI) 
      1. Open Command Prompt as Administrator. 
      2. Run: C:\Intune\Win32 
      3. Execute the tool: IntuneWinAppUtil.exe 
      4. Answer the prompts: 
         1. Source folder: Folder containing the MSI 
            C:\Intune\Source 
         2. Setup file: 
            YourApp.msi 
         3. Output folder: 
            C:\Intune\Output 
         4. Catalog folder: Press Enter (skip) 
      5. You’ll get: YourApp.intunewin 
3. Deploy the required applications to the Azure dynamic device group configured in the previous steps.

1. Use an existing or new Enrollment Status Page (ESP).
   1. Existing ESP: Configure the existing Enrollment Status Page as needed.
   2. New ESP: Create a new Enrollment Status Page using the wizard. 
2. Configure the ESP to include the applications that must be installed during device provisioning.
3. Assign the ESP profile to the Azure dynamic device group configured in the previous steps.
4. Verify the ESP assignment is successful and that all required applications are included in the profile, see below example.
    

Important: If the test device was previously joined to the on-prem domain, you may need to clear the TPM 2.0.

1. Reset the test device to factory settings and return it to the Out-of-Box Experience (OOBE). 
2. Power on the device. 
3. Do not proceed beyond the Country or Region screen, as Autopilot provisioning will not function correctly if this step is passed. 
   

1. At the Country or Region screen, press Shift + F10 or FN+Shift+F10 to open Command Prompt. 
2. From Command Prompt, open File Explorer by running: 
   > start explorer 
   
3. Open PowerShell by running: 
   > powershell 
4. Launch PowerShell ISE by typing:  
   > Ise 
5. Run the set the execution policy and install the Autopilot scripts: 
   > Set-ExecutionPolicy Bypass -Force 
   > Install-Script -Name Get-WindowsAutopilotInfo 
6. Run script the collect the hardware hash and export it to the Public Downloads folder: 
   > Get-WindowsAutopilotInfo -OutputFile C:\Users\Public\Downloads\HWID.csv 
7. 
8. Copy the serial number from the PowerShell screen as you will need it in a later step.

1. From Command Prompt, launch Internet Explorer: 
   > start iexplore 
   
2.  
3. Sign into the Intune admin center at url https://intune.microsoft.com/#home
4. From the left menu, select Devices. 
5. Then, from the center menu navigate to Device Onboarding and select Enrollment. 
6. Then in the right window, navigate to Windows AutoPilot and select Devices. 
7.  
8. From the top menu, select Import.
   
9.  
10. Import pane Add Autopilot devices will open. 
11. Select the HWID.csv from folder C:\Users\Public\Downloads. 
12.  
13. Device will import into Autopilot which can take a few minutes to complete. 
14. Close CMD, PowerShell and IE windows.

1. While still in Autopilot devices, after a few minutes, search for the device with its Serial Number that you copied in a previous step from PowerShell. 
2.  
3. Select the Device imported to open the device details pane. 
4. Assign the Group tag, see TAG1 below. 
   Important: Be sure the group tag assigning is in the Azure Group dynamic query. 
   
5.  
6. Select SAVE.

1. In the Intune admin center, navigate to Groups. 
2. Search for and open your Group. 
3. In center menu, select Members and confirm the device is listed. 

1. Reboot test device. 
   Note: This reboot will cause the device to get the ESP profile assigned. 
2.  
3. Device will restart to the Country or Region, Keyboard or Account screen. 
4. Press the Windows key 5 times. 
5. Select Pre-provision with Windows Autopilot and then select Next.
6.  
7. Device will check for updates.
8. The Pre-provision with Windows Autopilot screen appears. 
9. Confirm Organization and Deployment Profile and then select Next. 
10.  
11. The Device preparation phase begins. This may take several minutes to complete. 
12.  
13. Expand menu to view details. 
14.  
15. Once Device preparation completes, the process moves to Device setup. 
    Note: This step installs the Intune Management Extension (IME) app, and the Enrollment Status Page (ESP) required apps. 
16.  
17. Once Device Setup completes, process moves Reseal the device.  
18.  
19. STOP and DO NOT click Reseal. 
    

1. At the Your device setup is complete screen, press Shift + F10 or FN+Shift+F10 to open Command Prompt. 
2.  
3. From Command Prompt, open Programs and Features by running: 
   > appwiz.cpl 
4. Or open File Explorer by running: 
   > start explorer 
5. Confirm your Apps are installed. 
   1. If apps are installed, proceed to the next step.  
   2. Otherwise, start over at Step 2 and troubleshoot to resolve issues with apps not installing.  When starting over, you can skip steps for getting hardware hash and importing it. 

1. Select Reseal. 
2.  
3. The device powers OFF.

1. Power the device back ON. 
2. The device will check for updates and stop at the Let’s set things up for your work or school. 
3.  
4. Enter your account and select Next, then enter your password and select Sign in. 
5. Complete the required two factor authentication. 
6.  
7. Device setup processes again but does faster this time.  After Device setup completes, process moves to Account setup. 
8. Account setup process starts and completes. 
9.  
10. You are logged into Windows. 

1. Prompted to finalize recovery by the Reset process guide. Select Continue.
   
2.  
3. SupportAssist OS Recovery prompts for approval.  Select Decline and Close, it takes a couple minutes for window to close.
    
4.  
5. Windows Reset is complete. 
6. This is the end of production testing.