Autopilot enrollment via MDT

Hi all,

Within our organization, we’re implementing Microsoft Endpoint Manager to manage devices like laptops.

The situation is as followed: laptops are currently unmanaged and we’re trying to find a user-friendly way to enroll these laptops in MEM. Options to add a ‘Work or School account’ aren’t an option as users only have a ‘user account’ without admin rights. On the other hand, we’d like to take this opportunity to enroll a new (clean install) image with configurations and software from MEM.

After installing the OS with MDT and the offline JSON profile the device boots with the expected OOBE screen, ready to enroll in MEM. After entering the credentials the device is enrolled in AAD. Based on some rules the device is added to a dynamic group that is assigned to the ESP and configurations… probably AAD detects the membership too late which returns in a half-baked configuration.

We prefer to enroll without any manual interactions such as installing a provisioning package or running a PS-script from the OOBE-screen.

Any suggestions so devices will get their ESP and configuration profiles that are assigned to the group as pre-provisioning isn’t an option with offline Autopilot profiles?

Used resources:

https://docs.microsoft.com/en-us/archive/blogs/mniehaus/speeding-up-windows-autopilot-for-existing-devices

https://docs.microsoft.com/en-us/mem/autopilot/existing-devices

Thanks in advance!