This week is a short post about the Windows Autopilot deployment events that are registered in Microsoft Intune. In a way, a follow up post on this post of about a year ago. While that post was mainly focused on informing IT administrators about the status of Windows Autopilot deployments, this post will be more focused on awareness. Awareness for the deviceManagementAutopilotEvent resource type in Microsoft Graph that contains all the information about Windows Autopilot deployment events. It’s still an often forgotten resource type that does provide a lot of useful information about Windows Autopilot deployments and is also the basis for Windows Autopilot deployment report. This post will provide some more details of the properties that are available within that resource type, the content of the response, and examples for querying the resource type.
Overview of Windows Autopilot deployment events response
When looking at the Windows Autopilot deployment events, it all starts with the response that is provided by the deviceManagementAutopilotEvent resource type. That returns a long list with properties that are available for every Windows Autopilot deployment. Those properties can be used to filter Windows Autopilot deployments and to create insights based on those properties. The Windows Autopilot deployment report is based on this information. Below is an example of the response of the deviceManagementAutopilotEvent resource type in Microsoft Graph.
{
"@odata.context": "https://graph.microsoft.com/beta/$metadata#deviceManagement/autopilotEvents",
"value": [
{
"id": "autopilot_afbe9061-8862-4314-a9e6-b669c81613fc",
"deviceId": "afbe9061-8862-4314-a9e6-b669c81613fc",
"eventDateTime": "2023-03-30T18:04:53.7225512Z",
"deviceRegisteredDateTime": "2022-07-21T10:15:33.7242009Z",
"enrollmentStartDateTime": "2023-03-29T07:46:30.5444924Z",
"enrollmentType": "azureADJoinedWithAutopilotProfile",
"deviceSerialNumber": "8910-2429-1494-4937-3678-3882-11",
"managedDeviceName": "CLDCLN678388211",
"userPrincipalName": "ffd48409-bd0e-4f1f-a4ad-c525586bf890",
"windowsAutopilotDeploymentProfileDisplayName": "Windows Autopilot deployment",
"enrollmentState": "enrolled",
"windows10EnrollmentCompletionPageConfigurationDisplayName": "Default",
"windows10EnrollmentCompletionPageConfigurationId": null,
"deploymentState": "success",
"deviceSetupStatus": "unknown",
"accountSetupStatus": "unknown",
"osVersion": "10.0.22623.741",
"deploymentDuration": "PT13M34.412S",
"deploymentTotalDuration": "PT47M58.117S",
"devicePreparationDuration": "PT17.469S",
"deviceSetupDuration": "PT12M2.098S",
"accountSetupDuration": "PT1M32.313S",
"deploymentStartDateTime": "2023-03-29T07:46:13.0752268Z",
"deploymentEndDateTime": "2023-03-29T08:34:11.1919903Z",
"targetedAppCount": 1,
"targetedPolicyCount": 0,
"enrollmentFailureDetails": null
}
]
}Overview of Windows Autopilot deployment events properties
When looking at the response of the deviceManagementAutopilotEvent resource type, it provides IT administrator with a lot of information about the Windows Autopilot deployments. To be able to use that information in the right way, it’s important to be familiar with the different properties that become available per Windows Autopilot deployment. Below is an overview of all the available properties, including a short description of what it is and how it can be used.
| Property | Description |
|---|---|
| id | String that contains the UUID of the device object |
| deviceId | String that contains the device id associated with the device object |
| eventDateTime | DateTimeOffset that contains the time when the event occurred |
| deviceRegisteredDateTime | DateTimeOffset that contains the device registration date |
| enrollmentStartDateTime | DateTimeOffset that contains the device enrollment start date |
| enrollmentType | windowsAutopilotEnrollmentType that contains the enrollment type of unknown, azureADJoinedWithAutopilotProfile, offlineDomainJoined, azureADJoinedUsingDeviceAuthWithAutopilotProfile, azureADJoinedUsingDeviceAuthWithoutAutopilotProfile, azureADJoinedWithOfflineAutopilotProfile, azureADJoinedWithWhiteGlove, offlineDomainJoinedWithWhiteGlove, or offlineDomainJoinedWithOfflineAutopilotProfile |
| deviceSerialNumber | String that contains the device serial number |
| managedDeviceName | String that contains the managed device name |
| userPrincipalName | String that contains the user principal name used to enroll the device |
| windowsAutopilotDeployment ProfileDisplayName | String that contains the Autopilot profile name |
| enrollmentState | enrollmentState that contains the enrollment state of unknown, enrolled, pendingReset, failed, notContacted, or blocked |
| windows10EnrollmentCompletion PageConfigurationDisplayName | String that contains the Enrollment Status Page profile name |
| windows10Enrollment CompletionPageConfigurationId | String that contains the Enrollment Status Page profile ID |
| deploymentState | windowsAutopilotDeploymentState that contains the deployment state of unknown, success, inProgress, failure, successWithTimeout, notAttempted, or disabled |
| deviceSetupStatus | windowsAutopilotDeploymentState that contains the deployment status for the enrollment status page device setup phase of unknown, success, inProgress, failure, successWithTimeout, notAttempted, or disabled |
| accountSetupStatus | windowsAutopilotDeploymentState that contains the deployment status for the enrollment status page account setup phase of unknown, success, inProgress, failure, successWithTimeout, notAttempted, or disabled |
| osVersion | String that contains the device operating system version |
| deploymentDuration | Duration that contains the Autopilot deployment duration including enrollment |
| deploymentTotalDuration | Duration that contains the total deployment duration from enrollment to Desktop screen |
| devicePreparationDuration | Duration that contains the time spent in device enrollment |
| deviceSetupDuration | Duration that contains the time spent in device Enrollment Status Page |
| accountSetupDuration | Duration that contains the time spent in user Enrollment Status Page |
| deploymentStartDateTime | DateTimeOffset that contains the deployment start time |
| deploymentEndDateTime | DateTimeOffset that contains the deployment end time |
| targetedAppCount | Integer that contains the number of applications targeted |
| targetedPolicyCount | Integer that contains the number of policies targeted |
| enrollmentFailureDetails | String that contains the enrollment failure details |
Example Windows Autopilot deployment events queries
When knowing the different properties that are available via the deviceManagementAutopilotEvent resource type, it’s good to be familiar with how those properties can be used for filtering of data. Let’s walk through a few examples with some good filters for Windows Autopilot deployments. The following example filters all successful Windows Autopilot deployment.
https://graph.microsoft.com/beta/deviceManagement/autopilotEvents?$filter=deploymentState eq 'success'Besides looking at the deployment status, it can also be interesting to look at the enrollment type. In other words, to filter on how the enrollment was initially started. The following example filters all pre-provisioned Windows Autopilot deployments.
https://graph.microsoft.com/beta/deviceManagement/autopilotEvents?$filter=enrollmentType eq 'azureADJoinedWithWhiteGlove'In addition to looking at the enrollment type it can also be interesting to look at the primary user, as that can also be an indication of were in the process the deployment is. The following example filters all Windows Autopilot deployments without user during the enrollment.
https://graph.microsoft.com/beta/deviceManagement/autopilotEvents?$filter=userPrincipalName ne ''Another often used filter is simply looking at the deployment end date, as that indicates when the deployment is finished. The following example filters all Windows Autopilot deployments that are finished after the specified date.
https://graph.microsoft.com/beta/deviceManagement/autopilotEvents?$filter=deploymentEndDateTime gt 2023-03-29Besides that, it’s also possible to filter on all the different names of profiles that are used during deployments. The following example filters all Windows Autopilot deployment based on the specified deployment profile.
https://graph.microsoft.com/beta/deviceManagement/autopilotEvents?$filter=windowsAutopilotDeploymentProfileDisplayName eq 'Windows Autopilot deployment'Of course it’s also possible to combine all of these different filters by simply using the and operator. Many examples of that can be achieved can be found in this earlier post about getting started with filtering and selecting data.
More information
For more information about Windows Autopilot deployment events, refer to the following docs.
1 thought on “Working with Windows Autopilot deployment events”