AMA: Enrolling modern devices with Windows Autopilot

Actually DELL does. We buy our Windows 11 SKU with a included Self-Healing Image Recovery : https://www.dell.com/support/manuals/en-us/self-healing-image-recovery/shir_saosr_ug/introduction?guid=guid-ea57f10e-92c9-46c5-9b92-728a5e87f6bc&lang=en-us Should be available for you - take contact to your nearest DELL vendor :)

I agree 1,000,000%

Same here. Some times we just see that it fails - and cant find any reason why in the : Service health and message center - but then, waiting some time - it suddenly works agian. No idea why. Sometimes we have hade issues when doing Co-Management, and that will fail in the Device Preparation - but then we simply do run the "Connection Analyzer" for the Cloud Management Gateway - and then often its one of our Management Points that for some reason needs a "reboot". But still - we experience issues now and then, and if its around the first of the month where we typically onboard alot of new employees, then it becomes critically. 😞

Many, many times. 🙂 That's why our mantra to customers is: Keep it simple. We've found that the largest companies that use Autopilot have very high success rates because of the simplicity of their deployments (e.g., low number of apps deployed). The Autopilot flow is a very complex flow involving soooo many components. The typical randomizing inhibitors to success that we've found include: unreliable networks (e.g., schools, home) that can't take the number of apps configured by the IT admin; the number of apps configured for a user/device; very complex networking/security infra (e.g., proxies); country-specific network latencies.

Would be nice to discuss more on best practices regarding Endpoint Security during Autopilot, some list of features from Endpoint Security that needs to be configured from the start with Autopilot like BitLocker, etc

Autopilot is for provisioning new Windows endpoints and is unrelated to changing the configuration on previously provisioned endpoints. For existing devices, using co-management or group policy will enroll the endpoints in Intune.

Same setup on my side (WU in Prod, DevConfig in Pilot), but your devices are still domain joined, so most of those telemetry settings are included in the latest Win10 ADMX templates and can be passed via legacy GPO to the clients

Going to be a broken record here, but A, begin exploring and using Azure AD join instead of hybrid Azure AD join. There are many caveats, nuances, and "headaches" with HAADJ particularly for new Windows endpoint provisioning. See aka.ms/cloudnativeendpoints. For the specific question, note that saving the key to AD and AAD is the responsibility of the OS and that it only attempts to do this at the time the recovery password is set on the endpoint. Also, on an HAADJ endpoint, if it succeeds in storing to one location or the other (AAD or AD), then it considers the operation successful and moves on. With HAADJ during Autopilot, the HAADJ process doesn't actually complete until the user logs on which is after BitLocker gets enabled and thus there's no path for it to actually store the password in AAD at that time. To address this, you can use a PowerScript (run via a proactive remediation) to store the password in AAD. There are lots of sample scripts on the web for this, but ultimately, it's a one or two line PowerShell command. As noted though, this is one of those "headaches" with attempting to use HAADJ for new endpoint provisioning. and choosing AADJ, while more work in the short run, offers a large number of advantages in the long run including that it aligns with our engineering direction.