Questions about creating a provisioning package using Windows Configuration Designer

Question

Questions about creating a provisioning package using Windows Configuration Designer

隆大長村 20

Hello.

I am not very good at English, so I apologize if my writing is difficult to understand.

I am managing users and devices in my organization through Intune in an AAD environment.

I am deploying devices using Provisioning Package. When requirements arise such as adding new devices or re-registering devices after initialization, I periodically recreate the package due to the token expiration date.

Against this background, we have a question about the configuration items in Windows Configuration Designer.

In Step 3 "Account Management", when selecting "Enroll on Azure AD" within the "Manage Organization/School Accounts" section, there was an item called "Refresh AAD credentials".

I have not created any new packages recently, but this is the first time I have seen this item.

I am assuming that it is a setting related to AAD credentials, but it was difficult to get any critical information from it, even after looking into it. I have never seen such an item before, and I am having a hard time creating the package.

Does anyone know the details of this item and the impact of setting it?

I would appreciate your help.

If there is any missing information, we would appreciate it if you could point it out.

The OS of the device to be managed is Windows 10 and the version of the WCD is 2022.1118.0.0.

Translated with www.DeepL.com/Translator (free version)

Accepted answer

0 additional answers

Your answer

Answer 1

Crystal-MSFT 53,981 Microsoft External Staff

@隆大長村, Thanks for posting in Q&A.

The "Refresh AAD credentials" option in the "Enroll on Azure AD" step of Windows Configuration Designer's package creation process is related to updating the Azure AD credentials used for enrolling devices. When this option is selected, Windows Configuration Designer will prompt the user for Azure AD credentials during package installation, even if they have previously been provided. This can be helpful if the user has changed their Azure AD password or if there has been some other change requiring updated credentials.

Selecting this option will not have any impact on other configuration settings within the package.

Reference:

Provisioning Packages for Windows: What you can configure - https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provisioning-packages#what-you-can-configure

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

隆大長村 20 Reputation points

2023-06-08T09:25:12.67+00:00

Thank you for your prompt response.

Let me ask you a few questions.

In this case, does "credentials" refer to AAD administrative accounts or to the credentials of ordinary users under AAD management?

Also, by "even if they have previously been provided" do you mean from where to where?

Finally, when do you see a case where the credentials of a general user are updated during provisioning and another set of credentials are needed?

When we create a new provisioning package for updating tokens, the configuration items are selected following the previous example, but as a completely new package. In such a case, is it safe to set the "Refresh AAD credentials" item to "No" without any consideration?

Sorry for my lack of understanding. I would appreciate it if you could enlighten us.

Translated with www.DeepL.com/Translator (free version)
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2023-06-09T02:36:24.49+00:00

@隆大長村, Thanks for the reply.

The Bulk Azure AD token refers to the credentials of an AAD administrative account that has permissions to join a device to Azure AD,

For the other question, general users' credentials are not updated during provisioning. Instead, the Azure AD user account associated with the package is what is needed to join the device to Azure AD and enroll it in Intune management.

Regarding the last question, if you are creating a new provisioning package, it is generally safe to set the "Refresh AAD credentials" item to "No" since it is only needed when updating existing tokens, as stated in the reference provided. However, it is always best to review the settings carefully before creating the package to ensure they match your requirements.
隆大長村 20 Reputation points

2023-06-12T03:21:54.77+00:00

Thank you for your response.

I have found that it is generally better to set it to "No". Also, considering the environment I am currently managing, there seems to be no particular requirement to set it to "Yes", so I will set it to "No" for the time being.

Thank you very much for your patience with my poor English. If any more questions arise, I would love to ask them here.
Crystal-MSFT 53,981 Reputation points Microsoft External Staff

2023-06-12T05:30:30.35+00:00

@隆大長村, Thanks for your reply. I am glad to hear that the information can help. If there's anything else we can help in the future, feel free to post in our Q&A.

Thanks for your time and have a nice day!

Share via

Questions about creating a provisioning package using Windows Configuration Designer

0 additional answers

Your answer