Autopilot

Windows Autopilot is a cloud-based Microsoft service that enables the automated setup of new Windows 10/11 devices for productive use. The devices do not need to be reinstalled, as Windows Autopilot uses the existing image already present on the device. Relution supports automatic enrollment through Windows Autopilot, allowing Windows 10/11 devices to be quickly and easily added to the Relution inventory.

Requirements for using Windows Autopilot #

Windows Autopilot can be used with Windows 10/11 Professional, Enterprise, or Education starting with version 1709. To use it, a Microsoft Entra ID environment, a Microsoft Entra ID P1 or P2 license, and a Microsoft Intune Plan 1 license are required. To configure Microsoft Entra, users must have administrative permissions, for example the Global Administrator role. According to Microsoft documentation, the Microsoft Intune Plan 1 license should not be required. However, in practice it has been shown that Intune cannot be used without it. The license is only required for that purpose.

An internet connection is mandatory during the initial startup of Windows 10/11 devices so that automatic registration and setup can be completed.

Licensing requirements →

How Windows 10/11 device provisioning works #

When the Out Of The Box Experience (OOBE) starts on a Windows 10/11 device, the system automatically detects, if a network connection is available, that the device should be configured using Windows Autopilot. The device sends its ID to Microsoft and checks whether it has been registered in Autopilot for a Microsoft Entra ID environment. Users must then sign in on the Microsoft sign-in page using their credentials. After sign-in, enrollment in Relution is performed and a user account for the Microsoft Entra ID user is created on the device.

Advantages of Windows Autopilot #

The goal of Windows Autopilot is to avoid the need to manually install an internally created image on each new Windows 10/11 device. Instead, devices should transform themselves into preconfigured devices as automatically as possible. This minimizes the effort required to create and maintain images and reduces the time needed for physical registration and provisioning of devices. Microsoft Entra only needs to be configured once, and automatic registration continues to work until the defined expiration date of the client secret is reached (see Link Microsoft Entra ID →).

Entra Join #

Unlike Windows Autopilot, Entra Join is not intended for the automatic initial provisioning of a device, but for connecting the device to the company environment. Windows Autopilot is used to automatically provision and configure new devices, while Entra Join connects the device to the user in Microsoft Entra ID.

This user-based alternative to Windows Autopilot allows Entra users to enroll any Windows device. The device is joined to Entra ID via Settings → Accounts → Access work or school → Connect → Join this device to Microsoft Entra ID, followed by sign-in with the Microsoft user credentials. Entering credentials directly in the Connect dialog only registers the device with Entra ID (without joining it). Relution does not support this workflow and cancels it with an error.

Entra Join has the same requirements for the user and the Entra ID link as Windows Autopilot, see Automatic enrollment of Windows 10/11 devices in Relution →. An auto enrollment is not required for Entra Join.

Adding the MDM application in Entra #

The MDM application is created as part of linking Relution with Entra ID →: under Settings → User Management → Entra ID, the first step Create application of the Relution guide provides the required values. The link is then continued in the Application IDs step with the application ID and directory ID of this application.

Either the existing MDM application in Microsoft Entra can be used, or a new one can be created and fully configured using the values provided in the Relution guide.

The domain of the corresponding Relution Server is added in Microsoft Entra ID under Custom domain names. This process may take some time. Further information can be found in the Microsoft documentation.

Microsoft documentation →

Under Mobility (MDM and MAM), the desired MDM application is then added and activated:

1. Select the On-premises MDM application tile in the lower right corner.
2. Enter a name.
3. Click Add.

The new MDM application is then configured using the information provided in the Relution guide:

1. Select the desired setting for MDM user scope.

2. Enter the URL for the MDM terms of use from Relution:

   https://serverurl/api/device/v1/windows/termsOfUse
   

   Microsoft checks this URL before every enrollment. No website is opened.

3. Enter the MDM discovery URL:

   https://serverurl/api/device/v1/windows/discover
   

4. Click Save.

Check the Entra default settings and complete the setup #

After linking Entra ID with Relution → has been completed, the following settings under Devices → Device settings should be checked to enable Entra Join. This step can be skipped for Windows Autopilot.

• All users may join devices to Microsoft Entra ID.
• All users may register their devices with Microsoft Entra ID.
• The maximum number of devices per user should be taken into account.

Add Windows 10/11 devices #

These steps replace the previously required steps in Microsoft Store for Business.

New devices can be purchased and registered through a partner. In this case, the devices are automatically added to the Intune portal and to Microsoft Entra ID, so they do not need to be entered manually.

Devices that have already been used can be added manually. For this, a CSV file is required, which is generated on the devices using a PowerShell script. The CSV file is then uploaded to the Intune portal →, and the device can be reset afterward.

The file can be generated with the following script using PowerShell:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory -Path "C:\HWID"
Set-Location -Path "C:\HWID"
$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Install-Script -Name Get-WindowsAutopilotInfo
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

PowerShell must be run as Administrator.

The file must then be uploaded under Devices → enter Enrollment in the search → click the search result → scroll down on the right-hand side → Devices → Import.

The devices then appear in the device list and must be assigned to a configured profile.

Prepare the Out Of The Box Experience (OOBE) in Microsoft #

Next, a profile must be created.

To do this, the feature search is opened again: Devices → enter Enrollment in the search → scroll down on the right-hand side → Deployment profiles.

1. Click Create profile.
2. Select Windows PC.
3. Enter a name.
4. Click Next.
5. Click Next again.
6. Select either Add group or Add all devices.
7. Click Next.
8. Click Create.

The devices are now linked to the profile.

Synchronize stored Windows 10/11 devices with Relution #

Under Devices → Auto Enrollments, the Windows 10/11 devices can be added to Relution using the Sync devices button. This requires the Sync Autopilot devices option to be enabled in the Entra ID link (Services step of the Relution guide). At this point, the devices must not yet be enrolled.

The same step contains the Enable Autopilot enrollment option, which should remain enabled for Windows Autopilot. Both options are enabled by default for a new link.

In addition, Relution synchronizes the Autopilot devices automatically, every 24 hours by default. Devices that are no longer registered in Windows Autopilot are removed from the auto enrollments in the process.

Automatic enrollment through Windows Autopilot can only be carried out once the Windows 10/11 devices appear in the overview.

Automatic enrollment of Windows 10/11 devices in Relution #

After the devices have been reset, or when they are started for the first time, the network connection is established during OOBE. As soon as this is done, the devices communicate with Microsoft Entra and download the Autopilot profile.

The Microsoft account sign-in screen then appears. After users enter their credentials, communication with Relution takes place. First, the terms-of-use endpoint is called, and then enrollment in Relution is performed.

Enrollment requires exactly one user in Relution whose email address matches the Entra sign-in name (UPN), and an auto enrollment for the device. If a user is assigned to the auto enrollment, only this user can perform the enrollment. The Windows 10/11 devices then appear in the device inventory of this user’s organization and can be further configured using Windows policy configurations and actions.

As of Relution 26.5.5, Windows Autopilot and Entra Join additionally require that the Entra tenant the user signs in to is registered in Relution through an Entra ID link with the same Directory (tenant) ID. Links in the user’s organization, its meta organization and the global organization are taken into account (see Link Microsoft Entra ID →). Without a matching link, the enrollment is aborted. Relution only reports a generic authentication error to the device (Enrollment authentication failed). The server writes the exact reason to the log at level WARN with the text Rejected federated Windows enrollment (see Relution Logs →).

If a device enrolled through Windows Autopilot is deleted in Relution, it can be enrolled again using the same auto enrollment, even while it is still in the trash.