1:1 Device Auto Pilot onboarding network question

[mcolbourn]

We are looking into the 1:1 device route and using Autopilot to onboard them into Intune. But I have a little niggle in my head. To onboard the devices they must have a network connection to pick up the Autopilot config etc. Now If we give the devices out we have to give the uses access to a network. Now I cannot get my head round how we manage this, I just keep thinking that we are giving a very unfiltered SSID out to people! As currently with have a BYOD SSID with a Lightspeed Relay Captive Portal in the way but I know this will get in the way wont it certificate etc which it wont have at this point, and no way of install it either as windows has not be configured.

 

Now I just can't work out in my head the best way of doing this and just wonder how do other schools manage this?

[psydii]

At the most basic level without vendor specific tools... either a wpa2/3 secured network that is only switched on during deployments, or, perhaps if the end user is unboxing the device, 802.1x/user auth based network, I believe you can get public certs for authenticating the network to the device.

[mavhc]

SSID that only lets you get to the 300 websites you need to onboard?