Automatically assign Windows AutoPilot deployment profile to Windows AutoPilot devices

This week another (short) blog post about Windows AutoPilot. More specifically, about automatically assigning a Windows AutoPilot deployment profile to Windows AutoPilot devices. That makes it a lot easier for administrators, as this prevents the administrators from potentially forgetting to assign the deployment profile to newly imported devices. Great improvement. Also, I have to say that this subject is documented pretty good, but it could be easier to find. This post is mainly for creating awareness regarding this subject. I’ll provide the options regarding to grouping Windows AutoPilot devices and I’ll show how those options can be used to create a dynamic group.

Options

Let’s start by having a look at the configuration options regarding the grouping of Windows AutoPilot devices. The imported Windows AutoPilot devices are pre-created in Azure AD and, during that creation process, a few values are automatically set for those devices. Below is an overview of those different values.

Value Devices Explanation
[ZTDId] All Windows AutoPilot devices A unique value assigned to all imported Windows AutoPilot devices
[OrderID]:{YourOrderId} All Windows AutoPilot devices with a specific order Id An optional Id that can be specified when importing Windows AutoPilot devices
[PurchaseOrderId]:{YourPurchaseOrderId} All Windows AutoPilot devices with a specific purchase order Id An Id that is set by the OEM when importing Windows AutoPilot devices

Those different values can be used to create dynamic device groups within Azure AD. Below is an overview of the required queries per grouping of Windows AutoPilot devices.

Devices Query
All Windows AutoPilot devices (device.devicePhysicalIDs -any _ -contains “[ZTDId]”)
All Windows AutoPilot devices with a specific order Id (device.devicePhysicalIds -any _ -eq “[OrderID]:{YourOrderId}”)
All Windows AutoPilot devices with a specifc purchase order Id (device.devicePhysicalIds -any _ -eq “[PurchaseOrderId]:{YourPurchaseOrderId }”)

Note: These values can be seen by simply using Graph Explorer, querying https://graph.microsoft.com/v1.0/devices and looking for the physicalIds value.

Configuration

Let’s continue by having a look at how to use these different values and queries for actually grouping all Windows AutoPilot devices. The following 3 steps walk through the creation of a dynamic device group that can use the different queries mentioned earlier.

1 Open the Azure portal and navigate to Intune > Groups or navigate to Azure Active Directory > Groups to open the Groups – All groups blade;;
2 On the Groups – All groups blade, click New group to open the Group blade;
3a

AAD_DD_GroupOn the Group blade, provide the following information and click Create.

  • Group Type: Select Security;
  • Group name: Provide a valid name for the group;
  • Group description: (Optional) Provide a description for the group;
  • Membership type: Select Dynamic Device;
  • Dynamic device members: See step 3b;
3b

AAD_DD_RulesOn the Dynamic membership rules blade, select Advanced rule, provide one of the mentioned queries (depending on the type of AutoPilot devices selection) and click Add query;

Note: The example on the right is showing the query for all AutoPilot devices.

Once the dynamic device group is created it can used for assigning Windows AutoPilot deployment profiles. That enables the administrator to automatically assign a Windows AutoPilot deployment profile to all Windows AutoPilot devices.

Result

Let’s end this post by having a look at the results. Below, on the left, is a quick overview, via Microsoft Graph, about the device information of CLDCLN879139238. That shows the name of the device and the value related to all imported Windows AutoPilot devices. Below on the right is an overview of that same device, showing it as a member of the earlier created dynamic device group.

AAD_DD_Example2 AAD_DD_Example1

More information

For more information regarding the latest Windows AutoPilot features and the configuration steps, please refer to the following articles: