Autopilot deployment - first login to on-premises AD with always on VPN

[marcoorg]

Hey everyone, maybe someone could help. We have hybrid AD (on-premises + azure). I'm trying to configure always on VPN to work without user interaction during autopilot deployment. When user deploys his new notebook at home and autopilot just finished (it is offline domain-joined to on-premises AD), he need to login to the system using domain account. But unfortunately at home it is impossible without VPN. I found that it can be fixed with device tunnel - always on VPN (https://docs.microsoft.com/en-us/windows-server/remote/remote-access/vpn/always-on-vpn/deploy/always...) and tried to configure NDES service (https://msendpointmgr.com/2018/06/19/certificate-deployment-for-mobile-devices-using-microsoft-intun... )

Unfortunately when autopilot has finished at the Intune side for this computer there are device configuration profiles in pending state: SCEP certification request and deploy always on VPN profile. 

When user goes to the office, autopilot finish the configuration (creates device certificate and deploys VPN profile), but at home there are two tasks always in pending state. Do you have any idea what could be wrong? 

[#2]

Hi

I couldnt find information in your question (to be 100% sure) if this option is enabled: skip the AD connectivity check is enabled in the autopilot deployment profile

[#3]

@Rudy_Ooms_MVP thank you for your response. In Windows Autopilot deployment profile the setting Skip AD connectivity check (preview) is set to Yes.

[#4]

Are you perhaps able to re-configure that pre-login VPN so that the user can initiate the tunnel and authenticate via User Name/Password whilst leveraging MFA? Then the user should be able to reach the DC, complete login, and continue the autopilot process.

[#5]

Device tunnel is not displayed in the network icon. First login using domain account failed. I've tried to login to local admin account and checked that at this step there are no NDES cert and VPN profile configured yet. I've tried to push user VPN config but it's not deployed before first logon.
Now we have a workarround: third party VPN that is deployed correctly during Autopilot proces and allows to login to VPN and domain account together but finally we would like to switch this to MS Always On VPN.

[#6]

Thanks for the update. Which Third Party VPN did you go with? I'm aware of many using Cisco AnyConnect.

[#7]

We use FortiClient.