Conditional Access and -Online Device registration error
So there was an Issue creating new discussions yesterday and I ended up with a discussion with Heading only. :) We're using the Get-WindowsAutopilotInfo.ps1 script with the -Online switch to register our Entra Joined Devices, and the process is being blocked by Conditional Access. The sign-in logs point to Microsoft Graph Command Line Tools (App ID: 14d82eec-204b-4c2f-b7e8-296a70dab67e) as the blocker. Microsoft Support suggested whitelisting several apps, but unfortunately, that hasn’t resolved the issue—likely because the device doesn’t have the compliant state during online registration. We’re currently evaluating whether a dedicated service account with scoped permissions for Autopilot enrollment might be a workaround. Would be great to hear if anyone else has found a reliable solution.
Dell laptop runs OOBE several months after being registered and used
We have a Dell Vostro laptop that has started to bring up the Autopilot oobe after login and connected to Wi-Fi, this is several months after first configuration and monitoring with Intune. it started when the end user visited a colleague. It initially stuck on the ESP screen with no access to the internet, we used the accessibility button to connect to local Wi-Fi. We rebooted via a hard power reset and it ended up at the final section on the ESP page after the user used her pin to login, also same after email address to login. It doesn’t complete the OOBE process and let her get to her desktop. Remotely Intune EndPoint manager can monitor and restart the system. Has anyone had this? Intune Support have collected logs and compared with another Autopilot device and gives Intune a clean bill of health! User is couriering me the laptop as Intune Support feel it is either a Windows issue or a hardware one. Suggestions welcome Paul
Windows 365 Administrator built-in role getting 401 unauthorized when enrolling devices
I'm trying to enroll new devices using the get-windowsautopilotinfo script. For this task, I'm trying to use a user assigned with the built-in role "Windows 365 Administrator", which is a new role. https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#windows-365-administrator Based on the above article, the role has the "microsoft.directory/devices/create" action, with description "Create devices (enroll in Azure AD)". It even says the role can "Enroll and manage devices in Azure AD, including assigning users and policies". But when I execute get-windowsautopilotinfo -online in Windows 10 OOBE Powershell, and login with the Windows 365 Admin. user, I encounter the following error: add-autopilotimportedevice: system.net.http.httprequestexception: 401 unauthorized Anyone else encounter the same problem? Should I just wait a few months for Microsoft to fix the role? 🙂 I've tried waiting 24 hours after assigning the role, same error. It might be unlikely a delay-related issue, a few seconds after assigning the Intune Admin. role, the script executes flawlessly. I've also tried 2 users, 2 separate devices, same error.
Unattend.xml OOBE disable or preconfigure the screen for set up for personal or organization use.
Hi In my organization we create an image for our laptops by using sysprep in combination with an unattended.xml file. This works but we would like to limited the OOBE-fase as much as possible. But we cannot find the option to disable of preconfigure the screen for set up for personal or organization use. These are the options we already use in the Unattended.xml file. <OOBE> <HideEULAPage>true</HideEULAPage> <HideLocalAccountScreen>true</HideLocalAccountScreen> <HideOEMRegistrationScreen>true</HideOEMRegistrationScreen> <HideOnlineAccountScreens>true</HideOnlineAccountScreens> <HideWirelessSetupInOOBE>true</HideWirelessSetupInOOBE> <ProtectYourPC>1</ProtectYourPC> </OOBE> We know that this is possible by using AutoPilot in Intune but we would like to keep using a preconfigured imagefile. Thanks in advance! VincentLet us sign into our Personal Microsoft account when Installing/Resetting Windows 10 Enterprise
When we fresh Install or Reset our Windows 10 Enterprise edition, we only have the option to sign into our business Microsoft account (aka Microsoft 365). no option to sign into our Personal account. so the only way is to make a local account and then when we come to the desktop, sign into our Personal Microsoft account. this needs to change so we can use either business or personal account during OOBE when installing or resetting Windows 10 Enterprise edition. Upvote in feedback hub: https://aka.ms/AAc14lt
