Automatically assign Windows AutoPilot deployment profile to Windows AutoPilot devices

by

This week another (short) blog post about Windows AutoPilot. More specifically, about automatically assigning a Windows AutoPilot deployment profile to Windows AutoPilot devices. That makes it a lot easier for administrators, as this prevents the administrators from potentially forgetting to assign the deployment profile to newly imported devices. Great improvement. Also, I have to say that this subject is documented pretty good, but it could be easier to find. This post is mainly for creating awareness regarding this subject. I’ll provide the options regarding to grouping Windows AutoPilot devices and I’ll show how those options can be used to create a dynamic group.

Options

Let’s start by having a look at the configuration options regarding the grouping of Windows AutoPilot devices. The imported Windows AutoPilot devices are pre-created in Azure AD and, during that creation process, a few values are automatically set for those devices. Below is an overview of those different values.

Value Devices Explanation
[ZTDId] All Windows AutoPilot devices A unique value assigned to all imported Windows AutoPilot devices
[OrderID]:{YourOrderId} All Windows AutoPilot devices with a specific order Id An optional Id that can be specified when importing Windows AutoPilot devices
[PurchaseOrderId]:{YourPurchaseOrderId} All Windows AutoPilot devices with a specific purchase order Id An Id that is set by the OEM when importing Windows AutoPilot devices

Those different values can be used to create dynamic device groups within Azure AD. Below is an overview of the required queries per grouping of Windows AutoPilot devices.

Devices Query
All Windows AutoPilot devices (device.devicePhysicalIDs -any _ -contains “[ZTDId]”)
All Windows AutoPilot devices with a specific order Id (device.devicePhysicalIds -any _ -eq “[OrderID]:{YourOrderId}”)
All Windows AutoPilot devices with a specifc purchase order Id (device.devicePhysicalIds -any _ -eq “[PurchaseOrderId]:{YourPurchaseOrderId }”)

Note: These values can be seen by simply using Graph Explorer, querying https://graph.microsoft.com/v1.0/devices and looking for the physicalIds value.

Configuration

Let’s continue by having a look at how to use these different values and queries for actually grouping all Windows AutoPilot devices. The following 3 steps walk through the creation of a dynamic device group that can use the different queries mentioned earlier.

1 Open the Azure portal and navigate to Intune > Groups or navigate to Azure Active Directory > Groups to open the Groups – All groups blade;;
2 On the Groups – All groups blade, click New group to open the Group blade;
3a

AAD_DD_GroupOn the Group blade, provide the following information and click Create.

  • Group Type: Select Security;
  • Group name: Provide a valid name for the group;
  • Group description: (Optional) Provide a description for the group;
  • Membership type: Select Dynamic Device;
  • Dynamic device members: See step 3b;
3b

AAD_DD_RulesOn the Dynamic membership rules blade, select Advanced rule, provide one of the mentioned queries (depending on the type of AutoPilot devices selection) and click Add query;

Note: The example on the right is showing the query for all AutoPilot devices.

Once the dynamic device group is created it can used for assigning Windows AutoPilot deployment profiles. That enables the administrator to automatically assign a Windows AutoPilot deployment profile to all Windows AutoPilot devices.

Result

Let’s end this post by having a look at the results. Below, on the left, is a quick overview, via Microsoft Graph, about the device information of CLDCLN879139238. That shows the name of the device and the value related to all imported Windows AutoPilot devices. Below on the right is an overview of that same device, showing it as a member of the earlier created dynamic device group.

AAD_DD_Example2 AAD_DD_Example1

More information

For more information regarding the latest Windows AutoPilot features and the configuration steps, please refer to the following articles:

20 thoughts on “Automatically assign Windows AutoPilot deployment profile to Windows AutoPilot devices”

  1. Hi Peter,

    I’m getting the following error that invalid characters were found in the rule:

    Dynamic membership rule validation error: Invalid characters found in the rule.Invalid characters found in the rule: “ ”

    I’ve tried this on several tenants, do I need to activate Graph before I can use this query?

    Reply

    • Hi Michel,
      That’s a current issue with my blog that it messes with special characters like the double quotes. Simply paste the query and manually redo the quotes, as a workaround.
      Regards, Peter

      Reply

  2. Hi Peter, great post. I think the website layout messed up the quotes in the membership value. When I copy them straight of your website and paste them into my dynamic rule, the group will not be created due to an error: Invalid characters found in the rule. Invalid characters found in the rule: “ ”

    (device.devicePhysicalIDs -any _ -contains “[ZTDId]”) <- Not working
    (device.devicePhysicalIDs -any _ -contains "[ZTDId]") <- Works

    Notice the slight difference in the quotes…..

    Reply

  5. Hi Peter,

    I have added a windows 10 Surface Pro device to Autopilot through importing the .csv which shows up under Windows AutoPilot devices but doesn’t appear when I want to manually assign the device to a device group by searching its serial number. Any thoughts on this?

    Reply

  7. Hi Peter,

    I’ve found that after Autopilot reset on a Windows 10 device that the ZTDID value no longer appears in the physicalIds for the device under the GraphAPI – and therefore cannot be targeted with the dynamic device group query for Autopilot devices.

    Just wondering if you’ve found the same? And if there is another method to create a dynamic device group for Autopilot devices?

    Reply

  8. I’ve just tried to create the dynamic groups, and it doesn’t like those statements. Just found these on the MS site
    (device.devicePhysicalIDs -any (_ -contains “[ZTDId]”))

    Apparently needs the extra brackets

    Reply

  9. Hi Peter.

    I want to make a dynamic group with
    (device.devicePhysicalIds -any (_ -eq “[PurchaseOrderId]:123456789”)) and
    (device.devicePhysicalIds -any (_ -eq “[PurchaseOrderId]:012345678”))

    But every time when adding the second rule I get an syntax error, is it not posible to ad 2 almost the same lines?

    Harmen

    Reply
  11. Pingback: [Update Nov 2022]Help you pass the Managing Modern Desktops exam with the newly updated Microsoft MD-101 dumps

Leave a Comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.