Intune Autopilot – Part 2 – Moving in the right direction!

Cont.

So if you’ve read part one, then you’re looking for a way to set up an Intune managed Autopilot device to be shared among multiple users.

The chances are that you’re already using autopilot for your single-user devices. Which means that you already have an Azure AD Dynamic Group, probably using a dynamic query such as:

(device.devicePhysicalIDs -any (_ -contains “[ZTDId]”))

The problem with this approach is that it’s going to lump all of our autopilot devices into one AAD Dynamic group, which is no good if we need multiple deployment profiles (User Driven + Self-Deploying profiles). So we need a way to separate these devices. Enter the OrderID field…

The OrderID field, also referred to as GroupTag will allow us to create different groups of Autopilot devices, so that we can deploy Single User laptops, Shared PCs, and Kiosk devices all with different profiles and policy sets. However, if we are using the ZTDId tag, the chances are that none of our existing computers has the order IT field populated.

 

Therefore we need to populate the OrderID value for all existing devices and change our Dynamic AD groups to match the OrderID, not all autopilot devices.

Thankfully, Nicola Suter has come to the rescue here. He has written a PowerShell script that will connect to Graph API, and allow us to change the OrderID field in bulk. https://tech.nicolonsky.ch/bulk-update-windows-autopilot/ In this example. I’m going to use a group tag of “autopilot” to signify a standard user-driven deployed device, therefore we will use Nicola’s scripts to change the group tag to “Autopilot” on all existing devices.

 

In conjunction, with this, we also need to change the Dynamic group query in Azure AD from targeting ZTDid to something like this:

(device.devicePhysicalIds -any _ -eq “[OrderID]:Value”)

Where “Value” is the value, you want to put in the OrderID field.

Once we have done this, we can start building a new policy and profile set for our other devices. In part 3, we will explore a multi-user desktop and kiosk mode deployment alongside traditional user-driven deployments.