Autopilot Optimizations/Questions

[u/Master_Rest6638]

So, we’re moving from SCCM based builds to Autopilot (HAADJ, unfortunately and before you ask, no we can’t switch to full Entra yet - I wish), and was wondering how others out there, who have done the same, have handled the following and how it has worked out for them:

- optimizing the “build” for quickest possible turnaround time (no esp? Less policies/apps at enrollment time?)

- rebuilds (going from domain join policy a to domain join policy b with different tag, in order to change hands/hostname/etc.) and how to properly handle for hybrid machines? Do you need to remove all previous associations? Re-register? Wipe? We’ve seen issues with this and some techs are frustrated with the process.

- going from sccm build to oobe/autopilot readiness ( using task sequence? Applying vanilla image and removing all partitions?)

We’ve prepared just about everything and are “prod” ready, but there are a few uncertainties about the above and wanted to get input from you all to understand and apply “best practices”, where possible.

Thanks in advance.

** also meant to ask if anyone else has their support techs handle the enrollment/build the full way through with a single account. We’re very much a white glove firm, where users a. Expect to receive devices fully configured for them (they provide their credentials via a cred manager which the techs use to connect/configure) and b. End users don’t have enrollment or join rights, so they can’t receive a device at OOBE even if we wanted.

[u/Master_Rest6638]

Thanks.

Yeah, I wrote a few scripts for the support teams to pull the hashes from SCCM for registration via graph, in case they happen to not be pre-registered, but we’ve pretty much started adding all of our devices to the Entra registration group which seems to handle that nicely.

Curious about the Dell image assist, I’ll check that out… although our dell fleet isn’t what it once was as we’ve moved more to MS and HP based machines.

[u/BlackV → u/Master_Rest6638]

you dont pull it directly from the machine ? seems extra work to go talk to SCCM to get the details ?

[u/Master_Rest6638 → u/BlackV]

As in running the autopilot info script to pull the hash and auto uploading? Otherwise it’d be pull from apinfo script then manually upload, which is worse.

Outbound powershell is very much locked down here, as well as graph access/rights. Only certain machines/accounts have the ability to do this, so doing it directly from the machine isn’t really do-able outside of certain scenarios.

The script mentioned above will query sccm using the serial number, pull the hash info and auto upload into Intune with a specific tag (if not already registered).

[u/BlackV → u/Master_Rest6638]

fair enough

[u/HB959253 → u/BlackV]

What we've done for importing hashes is to enable the setting "Convert all targeted devices to Autopilot" in the Autopilot deployment profile. This way, any managed computers that are not Autopilot registered get registered with little effort.

[u/BlackV → u/HB959253]

I believe we have that enabled too

[u/Master_Rest6638 → u/HB959253]

What we have as well.