multiple autopilot profiles

[marcrr]

Hello, I am wondering how other companies handle multiple Autopilot Profiles. We will need at least 2 different Profiles to decide between admin and standard users.

But as the profile needs to be assigned to devices and not users, we will have to handle the group membership individually for each device. 

One Idea would be to only have one autopilot profile with standard users, dynamically assign all devices to this profile and handle the administrative users via a PowerShell script.

But I am not sure if this will work? Maybe some other ideas? 

Best Regards,

Marc

[#2]

Hi,

You can use OMA-URI:  ./Device/Vendor/MSFT/Policy/Config/RestrictedGroups/ConfigureGroupMembership
Value:

(Note: This is tested in Windows 10 1803 Enterprise)

[#3]

Hi

We are using order id on the Autopilot object to accomplice it.

Check this one out : https://osddeployment.dk/2018/07/22/how-to-auto-assign-windows-autopilot-profiles-in-intune/

Kind regards

Per Larsen

[#4]

Hi Per, I had a try with the OrderID and dynamic groups. It does work, but then we need at least 2 piles of laptops, one for admin and one for standard users. If we get more profiles even more piles.

If there’s no other way, this might be a consideration :) 

The CSP for managing the Admin Group would not get us a solution, because we need the user who is logged in assigned to the admin group and not a static group or user. 

I'm not sure if we can use a PowerShell script, at what stage during deployment the PowerShell scripts get executed? Can I get the logged on user within the script? 

It would be great if we can set the Admin/non Admin decision per User and not Device.

Best Regards,

Marc

[#5 · Accepted solution]

Hello,

I found a good a article that may be useful to you and or any one else out there.

https://triplesixseven.com/using-multiple-autopilot-profiles/

Essentially taking the device list you get from your supplier/reseller (or manually created through Get-AutoPilotInfo) and adding a unique identifier onto the end of each Device hash ID in the CSV file you get.

This then creates Deployment Groups to which you can use to Dynamically assign the machines to Dynamic Groups based on this unique identifier and then deploy unique software & settings to each Dynamic Group of machines.

If that makes any sense. :)