HomeImplementation

Technical source document

Implementation

Rendered from the retained public repository snapshot. Original wording and result boundaries are preserved.

Original GitHub document All documentation

Implementation

1. Pilot-scoped automatic MDM enrollment

Automatic Intune enrollment was scoped to SG-Intune-Autopilot-Pilot-Users.

2. Autopilot registration and targeting

A physical Lenovo endpoint was registered with Windows Autopilot and added to SG-Intune-Autopilot-Pilot-Devices. The device later reported the deployment profile as assigned.

3. User-driven Microsoft Entra join

AP UserDriven EntraJoin Pilot was configured for user-driven Microsoft Entra join, standard-user provisioning, and the device naming template AP-%SERIAL%.

4. Microsoft Entra branding

Custom background, banner, square logo, sign-in hint, and lab-specific sign-in text were configured and observed during live OOBE.

5. Enrollment Status Page

ESP Autopilot Pilot displayed provisioning progress and blocked completion while the required application and device configuration were processed.

6. Microsoft 365 Apps

M365 Apps Autopilot Pilot was required for the pilot device group. Post-enrollment validation confirmed O365ProPlusRetail on x64 Click-to-Run.

7. Compliance and remediation

Compliance Windows Autopilot Pilot initially reported BitLocker and Secure Boot as noncompliant. Local validation showed BitLocker was already fully encrypted while Secure Boot was disabled. Secure Boot was enabled in firmware and Intune was synchronized; the device then reported compliant.

8. Security configuration

Config Windows Autopilot Security Pilot applied BitLocker, Defender, firewall, PUA, and VBS controls. Final Intune check-in status showed 2 succeeded, 0 errors, 0 conflicts, 0 not applicable, and 0 in progress.

9. Administrative access

The Autopilot user remained a standard user. A separate tenant administrator was assigned the Microsoft Entra Device Administrators role. UAC elevation was validated before running administrative endpoint checks.

10. Safe reset preparation

Before destructive reset, selected lab/business data and recovery-critical configuration were backed up to an SMB share. Secret-bearing recovery files are intentionally excluded from this public repository.