Intune enrollment

[Erasure]

Hi guys

 

We are planning to gradually adopt Intune and I have a question on bulk enrollment of devices, hoping to find out what others have done

 

We are not at a stage yet for devices to be purely cloud joined. For the moment, devices will exist in Active Directory and Entra so will be Hybrid-Joined.

Devices are built and domain joined using MDT.

 

I have tested device enrollment into Intune using a Device Enrollment Manager + GPO. Below would be the workflow to enroll a device into Intune:

 

1. Pre-stage computer account in AD and it then sync to Entra using the AAD connect tool.
   
2. Add object to any security groups for Intune application installs.
   
3. Build device using MDT.
   
4. Confirm build is successful & reboot.
   
5. Device will register in the Entra portal in due course.
   
6. Once device is registered, log in using the Device Enrollment Manager account.
   
7. Device enrolls into Intune.
   
8. Monitor enrollment within Intune portal and configuration profiles/apps will soon deploy from Intune.
   

 

We are wanting to bulk enroll hundreds of devices into Intune and so far the use of a DEM account is the only way I can see it working.

I've thought that the process could be sped up by utilizing Impero to log on as the DEM account for clasrooms of 30+ devices.

 

Hoping to see what others have done regarding bulk enrollment , unfortunately we don't have SCCM so unable to use co-management.

 

Many thanks!

[lparry]

We've got it working in a slightly different way - might not fit your use case but always good to see multiple options!

 

1. Device gets imaged via MDT and gets placed in AD
   
2. GPO object hybrid joins the device to Entra
   
3. Device name allocates it into dynamic entra groups to allocate applications/policies.
   


1. Example device name could be ABC-P-ICT-01
   
   1. ABC defines the school - lets say it stands for Alpha Bravo Campus
      
   2. P defines its a pupil computer
      
   3. ICT defines it as a computer in the ICT department
      
   4. 01 is just its identifier
      

    

   [*]This would then assign all ICT software and student policies for Alpha Bravo Campus & any Global policies

    

   [*]InTune picks up the device from Entra and does the rest.

    

    

   I'm sure I may have skipped over a step or two but thats the gist!

   
   

Edited May 14, 2024 by lparry

[browolf]

We've got it working in a slightly different way - might not fit your use case but always good to see multiple options!

 

1. Device gets imaged via MDT and gets placed in AD
   
2. GPO object hybrid joins the device to Entra
   
3. Device name allocates it into dynamic entra groups to allocate applications/policies.
   


1. Example device name could be ABC-P-ICT-01
   
   1. ABC defines the school - lets say it stands for Alpha Bravo Campus
      
   2. P defines its a pupil computer
      
   3. ICT defines it as a computer in the ICT department
      
   4. 01 is just its identifier
      

    

   [*]This would then assign all ICT software and student policies for Alpha Bravo Campus & any Global policies

    

   [*]InTune picks up the device from Entra and does the rest.

    

   Is the software installed via AD?

   
   

[lparry]

Nope - gets pushed from Intune also

[pablo007]

We join ours to intune via gpo

 

if you mean general Apps office, vlc etc., these are installed by the MDT build, or later via intune or still occasionally by PDQ.

[lparry]

Looks pretty much same to ours but our GPO has 1 extra setting (not sure why - was setup before me!)

[pablo007]

I admit i've never seen that setting before but a quick search of tinternet shows,

 

The “Register domain-joined computers as devices” Group Policy setting is used to automatically register domain-joined computers as devices in Azure Active Directory (Azure AD). When enabled, it allows seamless integration between on-premises Active Directory and Azure AD. However, it’s important to note that this setting is different from the MDM enrollment setting. While MDM enrollment is related to mobile device management, the “Register domain-joined computers as devices” setting specifically deals with Azure AD registration. If you want to enable Azure AD registration for domain-joined computers, you can enable this setting.

[browolf]

We join ours to intune via gpo

[ATTACH=CONFIG]71517[/ATTACH]

 

if you mean general Apps office, vlc etc., these are installed by the MDT build, or later via intune or still occasionally by PDQ.

 

we don't use mdt or pdq. can the general apps be installed by gpo instead of intune?

[psydii]

The enrol in AAD GP I think exist these days to give DA's a way to *prevent* the default behaviour of an AD Domain Computer joining AAD.

 

 

More info on how to enrol to Intune via GPO:

https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy

This should get your existing devices onto Intune without a re-image or having to touch them.

[pablo007]

we don't use mdt or pdq. can the general apps be installed by gpo instead of intune?

 

Yes absolutely https://learn.microsoft.com/en-us/troubleshoot/windows-server/group-policy/use-group-policy-to-install-software