Update: Starting with Intune’s July (2207) service release, we’re excited to announce that some key Windows Autopilot functionality has been securely returned. Thanks to your patience and feedback, we were able to securely bring those features back. To learn more, see: Return of key functionality for Windows Autopilot sign-in and deployment experience for more information.
At Microsoft, we want to ensure that we are providing our customers with features that help to increase productivity and securely protect organizations. To improve the baseline security for Windows Autopilot, we recently made a few changes that affect new Windows Autopilot deployments:
The intent of this post is to provide more context on why we made the changes and to provide links to documentation to help you be successful with your Autopilot experience.
Why did the Windows Autopilot team make these changes?
This was the biggest question we’ve received so far from customers. You liked, for example, giving a teacher a set of computers and using the welcome screen so the teacher could know which student to assign each device to. It’s a cool user experience when you assign a device, ship the device, and then the user opens that PC, and it welcomes them.
We loved the experience too! However, we made the changes because the reuse of hardware components, such as motherboards, or the refurbishment of devices without deregistration could potentially cause an issue if the device identifier can still be linked to a previous company. Hardware is being reused at record levels, partly due to the pandemic’s effect on global supply chains. While this reuse helps meet corporate sustainability goals, we had to remove the could and ensure no issues were caused. To date, we have found no evidence that anyone has used this to their advantage.
We are in the early design stages of an experience that customizes Autopilot enrollment. Using best practices from other enrollment workflows, we're looking at alternative solutions to reinstate this feature securely. Our goal is to improve your productivity and delight your users with what we bring back to the enrollment experience.
If you have questions or comments for the Intune team, reply to this post or reach out to @IntuneSuppTeam on Twitter.
01/11/22: Updated Additional Information section.
02/24/22: Updated post with additional clarification that while the username or UPN will not be displayed, any user targeting during pre-provisioning will still occur during the technician phase.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.