Microsoft Autopilot - User and Technician Build

[Stephen_UK]

I have recently joined a school who use Autopilot/Intune, though the setup is haphazard, largely undocumented and little is known about it. I am also trying to get my head around it having not used it before

 

We have a hybrid setup, so have to use this approach for Autopiloting devices.

 

All our devices are built and "tinkered" by IT and then handed out - they never go to a user in a state where they would be running the user build themselves

 

The guideline I have been given internally is that we run the technician build, and then log in as ourselves to complete the build. The latter then assigns "us" as the primary user of the device. As we are hybrid, I don't think there is any way to avoid this?

 

But equally, in our situation, is there any advantage to running the technician build and then following with the user, or should we just go straight in with the user build and cut out of the middle man, as it were?

 

Presumably if we ever go fully cloud, technician/shared device build becomes an option (and get "nicer" computer names!) but we are miles off that at the moment

 

Thanks in advance for any pointers

[itskdog]

You could generate a Temporary Access Pass (TAP) in the Entra Admin Centre if you wanted to complete OOBE as the user to save you reassigning the Primary User manually later. You could then log the user out and then log in as a local admin to apply any customisations (though I hope that shouldn't be too many, as most things should be able to be automated through Intune or GPO - the only application I've come across that I haven't been able to automate has been the Paxton Net2 Client, and that's not needed on too many PCs anyway)

[Stephen_UK]

Thanks - I wasn't aware of TAP so that is useful

 

Process wise, do you (or anyone else) know if there is any difference between running the technician build, followed by the user driven build as opposed to only running the user driven build?

 

I am presuming that the technician build would install device wide apps etc to save a (proverbial in our case) end user having it all to install when they did their own first provision (say if it was sent to their home directly and IT were hands off for the initial setup)

[itskdog]

Pre-provisioning is designed for if you're going to get the device enrolled to Intune but the user will complete OOBE.

 

If you're just going through OOBE in one go, I don't see any use of making yourself wait the 90 minutes between resealing the device and then unsealing it later. Just do it all in one go.

Edited December 2, 2025 by itskdog