Auto Enrollment during OOBE does not work (Windows 10)

Question

Hi everybody,

we want to use the bulk enrollment option during OOBE (using a provisioning package - PPKG) as described by Microsoft in the following link for Windows 10 (1909+): https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-bulk-enroll

AAD Join works correctly, but the AutoEnrollment into Intune doesn't.

The AutoEnrollment will only work if the "MDM user scope" is set to "ALL". But we want to set the "MDM user scope" to "Some". We set it to "Some" and defined a AAD group (e.g. Intune_MDM_AutoEnrollment) and added the users to this group. But this won't help as the user does not initiate the enrollment process into Intune.

Even if we add the user "package_..." - which was created during the creation of the provisioning package (see link above) - to the AAD group the enrollment won't work.

Is there any chance to get this working without setting the MDM user scope to All?
(Why we don't want to set it to "ALL"? Not all users should have the option to enroll devices into Intune as Intune should be used in a single location at the moment).

Thanks in advance.

Regards,
Phil

Answer 1

Out of interest, what was the reason for wanting to use that method rather than Autopilot to do the enrollment?

Answer 2

Because we only have a few clients (about 20) that should be enrolled into Azure AD and Intune at the moment. As this method is documented by Microsoft we thought this way should work.

Answer 3

The devices enrolled by bulk enrollment are not associated with any user accounts. To meet your requirements, you can just use automatic enrollment instead of bulk enrollment.

During OOBE, you don't need to deploy the provision package, instead, you just enter the Azure AD user accounts during the stage for sign in with Microsoft(Please see the screenshot). This can join in Azure AD and enroll in Intune automatically.

Plus, before the enrollment, please make sure the user accounts have been assigned the Intune license, and added in the AAD user group. The AAD user group should be added in the "MDM user scope".

Update
======

If you need to grant only standard user privileges to the AAD user accounts, and use the %SERIAL% macro for the computer name, you can enroll the devices with Windows AutoPilot. For more details, please click the following link.

https://learn.microsoft.com/en-us/mem/autopilot/enrollment-autopilot

Just for reference, you can view the profile settings for Autopilot in Intune as below.

---

If the response is helpful, please click "Accept Answer" and upvote it.

Answer 4

Thanks for your reply and your ideas.

Yes, we also tried this way and it is working with Azure AD Join and Intune Enrollment. But there are two points for which we didn't find a solution with this way:

1.) How can we set the correct computername? (%serial% should be used)
2.) Is there a way that the normal user for the device won't be a local admin? (we can enroll the 20 devices with an admin user, but therefore the assignment for the user won't be set correctly)

If we find a solution for these two topics than this way would be easier than the provisioning profile.

Answer 5

The only way to use AutoPilot is the "Get-WindowsAutoPilotInfo.ps1" script if the data is not delivered or imported by the OEM - or is there another option to import the clients into Intune?