This browser is no longer supported.
Upgrade to Microsoft Edge to take advantage of the latest features, security updates, and technical support.
This document will describe a common scenario we have identified within customer environments where the Wi-Fi is restricted by MAC addresses, or certificates are required to join Wireless networks.
Many customers in secure environments have restrictions on their Wireless or wired networks that will only allow approved devices (based on MAC Addresses) to connect successfully. This may be enforced through MAC Address filtering on a Wireless Access Point or through a DHCP server. Additionally, some Wireless networks can be protected with PEAP, which requires that a certificate be applied to the device prior to authenticating on the Wireless network.
In this scenario, two key requirements may introduce delays or require manual intervention when joining HoloLens devices to the network:
The core challenges with the requirements above are:
The MAC Address can currently only be identified from the Settings app on the device, or from Intune after a successful enrollment.
Without the MAC address, the device cannot join the Wi-Fi Network to begin enrollment.
Manual workarounds to these challenges require a technician to interact with the device.
There are many ways to improve this situation, depending on the infrastructure available within the environment.
| Solution | Benefits | Requirements |
|---|---|---|
| Provisioning Package with Ethernet Adaptor | Improves OOBE experience and allows for a quicker technician experience. | HoloLens compatible USB-C Hub + Ethernet adaptor, and technician will still need to interact with the device for MAC capture and OOBE finalization |
| Autopilot with Intune Registration over Ethernet | This is a single-step connection and registration of the device to the customer environment. MAC capture can be completed without needing to interact with the device | Intune enabled for the customer Microsoft Entra tenant and a HoloLens compatible USB-C Ethernet adaptor |
| Automated reporting of MAC Addresses | When devices are registered with the Intune tenant, a script can report the MAC address to the technician. | Intune PowerShell cmdlets |
Note
If the wired network is also subject to MAC restrictions, then the MAC address of the USB-C Hub + Ethernet adaptor will also need to be pre-approved. Care should be taken with this adapter as it will allow access to the network from other devices.
The Process may vary depending on the software level of the device. If the device has the May 2004 update, follow the steps below.
If the device has an OS build before the May 2004 update, follow the steps below.
This will allow a "Single touch" of the device, to apply the correct provisioning package and gather the MAC address of the device. Provisioning packages can be created following the guidance here.
This will allow a customer with advanced networking requirements to enroll the devices in a hands-off, scalable approach
Additional pre-requisites will be needed as below:
Connect the ethernet cable to the adapter and plug the adapter into the USB-C port on the HoloLens 2 device.
Turn on the HoloLens.
The device should automatically connect to the internet during OOBE via the Ethernet adaptor. It should detect the Autopilot configuration and automatically register with Microsoft Entra ID and Intune.
The Device will apply the required Wi-Fi Certificates and other configuration as needed via Intune.
When complete, the technician can load the Intune (Endpoint Manager) Portal and drill into the device properties page at Home -> Devices -> DeviceName -> Hardware.
The Wi-Fi MAC address will be visible within the Intune Portal.
The technician will add this MAC address as an allowed device.
This will allow a "Heads off" deployment experience for the Technician, with the device being able to go from the box to enrolled in Microsoft Entra ID and Intune without the technician having to wear the device or manually interact with the HoloLens environment.
At present, there is no "simple" way to trigger an automation command based on the enrollment of a new device within Intune. Therefore, this command will provide the technician a simple way to retrieve the MAC address without needing to log onto the portal and manually retrieve it.
Import-Module Microsoft.Graph.Intune
Connect-MSGraph
Get-IntuneManagedDevice -Filter "model eq 'Hololens 2'" | where {$_.enrolledDateTime -gt (get-date).AddDays(-30)} | select deviceName, wiFiMacAddress
This will return the name and MAC address of any HoloLens devices that have been enrolled in the last 30 days.
After the Intune enrollment has completed, the Technician would run the above script to retrieve the MAC address.
Training
Module
Enroll devices with Intune for Education and Autopilot - Training
This module teaches education partners how to enroll devices with Intune for Education and Autopilot. This module is part of the Partner Success Series.
Certification
Microsoft 365 Certified: Endpoint Administrator Associate - Certifications
Plan and execute an endpoint deployment strategy, using essential elements of modern management, co-management approaches, and Microsoft Intune integration.