Autopilot not working in test environment

Jason P 136

I have got a MS Dev 365 subscription (E5 basically).

I am trying to get to grips with Autopilot and have set it all up, and to the best of my knowledge, just as the documentation states.

I have two VMs. One windows 10 and the other 11. Both are Windows Pro editions. I have imported the hardware information into intune using the script (Get-WindowsAutoPilotInfo.ps1) and then I have reset the the installations (I have also tried doing a sysprep generalize). I have checked in intune and they are all there and they are assigned (They populate the AAD Dynamic Group correctly)

When both reboot and start the OOBE, neither of them seem to download the enrollment profiles. They just go straight to the language and location page. They are running on a Hyper V Instance and have internet connectivity.

I have gone through and recreated everything as well as re imported the csv files. I have even done an Online import with the script. They all import without any failures.

I am pretty stumped and if anyone can help that would be greatly appreciated.

Thanks

Rahul Jindal [MVP] 9,891 Reputation points MVP

2023-09-20T09:13:13.8433333+00:00

What kind of AP enrollment method have you configured?
Jason P 136 Reputation points

2023-09-20T09:15:16.1733333+00:00

Can you elaborate on that. Not sure what you asking for
Niklas 181 Reputation points

2023-09-20T09:48:35.08+00:00

Within the Deployment Profile:

User driven or Self?

In the oobe, you will see normally every time Region settings, after that you have to choose WiFi internet access if not via cable and then it will "start". You should see a login page where you need to enter your azure ad credentials
Jason P 136 Reputation points

2023-09-20T09:59:26.5633333+00:00

It is set to User driven, but all the online material I have says that if the deployment profile is set to hide all of that then it should go straight to the credentials page. It should not show any region, keyboard or license screens. These are all "cabled" as they are VMs running on HyperV.
Niklas 181 Reputation points

2023-09-20T10:01:52.3466667+00:00

almost same settings here and i have to choose Language every time. Language settings run before the deployment profile "starts"
Jason P 136 Reputation points

2023-09-20T10:22:21.0966667+00:00

I tried going through the whole oobe to the sign in (which I should not have to as the Deployment profile should handle that especially if the devices are imported into AutoPilot) and when I get to the sign in there is no corporate branding there either which there should be.

It just does not seem to be getting anything from intune at all for the profiles.
Niklas 181 Reputation points

2023-09-20T10:27:22.99+00:00

Okay, can you check the MDM Settings:

MDM Scope is set to all?

Also all DNS records are there?
Niklas 181 Reputation points

2023-09-20T10:29:51.1433333+00:00

also under Autopilot Devices the Profile has been assigned? No status "assigning"?
Jason P 136 Reputation points

2023-09-20T10:48:05.47+00:00

So I just before seeing this I changed the user scope to none, and it suddenly sprung to life as it was set to all.

Very odd. Why would this be ?

And if I set to Some, what group would I have to put in there?
Niklas 181 Reputation points

2023-09-20T10:55:57.8966667+00:00

MDM User scope is used to define which USERS will be able to enroll their devices into Intune as part of automatic enrollment. If set to "NONE", no one can join their device.

i personally added a group of USER´s there which are allowed to join their device to Intune. in my case, i have company owned devices which should be managed and on the ohter hand, i have people which devices should not be automatically enrolled because they are belonging to another company.

Would be awesome if you acceppt my comment :-)
Jason P 136 Reputation points

2023-09-20T11:06:26.8933333+00:00

It looks like you can't accept a comment only an answer ... Which is kinda dumb if you ask me.

So if you repost as an answer I will mark it as accepted. :-)

Thank you for your help. Very much appreciated.
Niklas 181 Reputation points

2023-09-20T11:08:47.9033333+00:00

done. Thanks a lot
Jason P 136 Reputation points

2023-09-20T11:32:55.2666667+00:00

Just to add to this. In this article (https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enroll) it says :

For corporate devices, the MDM user scope takes precedence if both MDM and MAM user scopes are enabled. The device will get automatically enrolled in the configured MDM

And even the screen shot there shows what I had originally as both set to all. It makes no sense that a corporate device that I have imported into intune does not run through the enrollment (as it should take precedence).

From all this I am understanding that setting MDM User scope to all means that all users that have a corporate device can enroll that device, which is what I want. Setting it to none would mean no one would be able to enroll it when they sign in to the device.

Am I getting this logic wrong ?
Niklas 181 Reputation points

2023-09-20T11:37:22.5733333+00:00

From all this I am understanding that setting MDM User scope to all means that all users that have a corporate device can enroll that device, which is what I want. Setting it to none would mean no one would be able to enroll it when they sign in to the device.

Thats what i wrote in my last comment :-)

if you have no MAM Policies configured, MAM will not do anything.
Jason P 136 Reputation points

2023-09-20T14:47:21.3333333+00:00

Well .... no idea what the hell is going on now ... I reset it everything to All for both MDM and MAM User Scopes. Reset the VM. removed the device from intune (tested the VM that it did not run any AP Profile) and re-imported the CSV file of the HW Info back into intune .... powered the VM back up and it works. Runs the AP Profile as configured .... WTF.... Exact same settings I had before when it was not working ... Makes no sense at all ...
Niklas 181 Reputation points

2023-09-20T14:57:02.8033333+00:00

just to let you know, you can add the HW ID directly via the sript to the portal.

get-windowsautopilotinfo.ps1 -online

Then you dont need to import the csv manually.
Jason P 136 Reputation points

2023-09-20T15:25:36.6033333+00:00

Yes I know that ... done that a couple of times. just that I had the csv on my desktop as I was using the same machine over and over again. Thanks

Accepted answer

Niklas 181 Reputation points

2023-09-20T11:08:53.3266667+00:00

MDM User scope is used to define which USERS will be able to enroll their devices into Intune as part of automatic enrollment. If set to "NONE", no one can join their device.

i personally added a group of USER´s there which are allowed to join their device to Intune. in my case, i have company owned devices which should be managed and on the ohter hand, i have people which devices should not be automatically enrolled because they are belonging to another company.

Would be awesome if you acceppt my comment :-)
Please sign in to rate this answer.

0 comments No comments
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Autopilot not working in test environment

0 additional answers

Your answer