Skip to main content

Migrating to Microsoft Intune

Overview​

A checklist and guide for onboarding units into Intune. All steps here will be performed by the UEM and platform engineering teams.

These documents are essential to operating within the Intune environment and should be provided to the UNIT.

Prerequisites​

Intune and Entra Onboarding Checklist​

This checklist outlines the process for onboarding a new unit into Intune for Autopilot and Entra ID for group management.

1. Prerequisites & Information Gathering​

  • Verify Permissions:
    • Confirm you have the Groups Administrator role for the target Administrative Unit (AU) via PIM.
  • Confirm Dependencies:
    • Verify that the corresponding AUTH MECM Location and Device Collections have been created.
  • Gather Unit Information:
    • Unit Code: [UNITCODE]
    • Department Scope Tag: [SCOPE TAG NAME]
    • Autopilot Group Tag: [GROUP TAG NAME] (Must not contain spaces)

2. Intune Configuration​

  • Step 1: Create Intune Scope Tag

    • Name: [SCOPE TAG NAME]
    • Assign the Scope Tag to the unit's admin group.

  • Step 2: Create Autopilot Groups

    • PIM to Groups Administrator role for the target AU.
    • Create Assigned Role Scope Group (RSG) (Optional, if one doesn't already exist)
      • Name: RSG - [UNITCODE] - All Autopilot Group Tag Assigned Groups
      • Membership Type: Assigned
    • Create Dynamic Device Scope Group (DSG)
      • Name: DSG - [UNITCODE] - Autopilot - [TYPE] - [GROUP TAG]
      • Type: [Self-Driven or User-Driven]
      • Membership Type: Dynamic Device
      • Dynamic Query: (device.devicePhysicalIds -any (_ -eq "[OrderID]:[GROUP TAG]"))
    • Add the new DSG as a member of the Autopilot RSG.

  • Step 3: Create Autopilot Deployment Profile

    • Navigate to Devices > Windows > Enrollment > Deployment Profiles and create a new profile.
    • Basics:
      • Name: [UNITCODE]_[PROFILE_TYPE]_PROFILE
      • Convert all targeted devices to Autopilot: Yes
    • Out-of-box experience (OOBE):
      • Deployment mode: [Self-Deploying or User-Driven] (Match the DSG type)
      • Apply device name template: Yes
        • Template: [UNITCODE]-%SERIAL%
    • Assignments:
      • Assign to the RSG - [UNITCODE] - All Autopilot Group Tag Assigned Groups group.
    • Scope tags:
      • Assign Default and the unit-specific [SCOPE TAG NAME].

  • Step 3: Create Enrollment Status Page (ESP)

    • Navigate to Devices > Windows > Enrollment > Enrollment Status Page and create a new profile.
    • Basics:
      • Name: [UNITCODE] - Enrollment Status Page
    • Settings:
      • Show app and profile configuration progress: Yes
      • Block device use until required apps are installed: Selected
        • Select the specific, critical apps for this unit.
      • Allow users to use device if installation error occurs: Yes
    • Assignments:
      • Assign to the RSG - [UNITCODE] - All Autopilot Group Tag Assigned Groups group.
    • Scope tags:
      • Assign Default and the unit-specific [SCOPE TAG NAME].

  • Step 4: Collect and Import Devices

    • Collect and Import Device Hashes:

  • Step 5: Verify Supporting Policies