1
00:00:00,040 --> 00:00:01,320
Imagine unboxing a brand new
2
00:00:01,320 --> 00:00:02,680
work laptop and watching it set
3
00:00:02,680 --> 00:00:03,680
itself up for your company
4
00:00:03,680 --> 00:00:04,879
without an IT person in the
5
00:00:04,879 --> 00:00:05,280
room.
6
00:00:05,280 --> 00:00:07,820
That's the promise behind
Windows Autopilot, and it's why
7
00:00:07,820 --> 00:00:10,720
a new hire can be productive on
day one instead of day five.
8
00:00:10,720 --> 00:00:11,660
We're going to break down what
9
00:00:11,660 --> 00:00:13,400
autopilot actually is, how a
10
00:00:13,400 --> 00:00:14,560
device gets claimed by your
11
00:00:14,560 --> 00:00:15,800
organization before it's even
12
00:00:15,800 --> 00:00:16,480
unboxed.
13
00:00:16,480 --> 00:00:18,640
And the one idea that makes the
whole thing work.
14
00:00:18,640 --> 00:00:22,600
Welcome to the M365 FM podcast,
where we explore the people,
15
00:00:22,600 --> 00:00:25,079
ideas, and technologies shaping
the future of work.
16
00:00:25,079 --> 00:00:26,760
If the words hardware, hash and
17
00:00:26,760 --> 00:00:28,039
deployment profile have ever
18
00:00:28,039 --> 00:00:29,559
sounded like a foreign language,
19
00:00:29,559 --> 00:00:31,000
this is the episode that fixes
20
00:00:31,000 --> 00:00:31,719
that.
21
00:00:31,719 --> 00:00:33,920
What autopilot actually is.
22
00:00:33,920 --> 00:00:37,280
For most of the last twenty
years, handing out a new laptop
23
00:00:37,280 --> 00:00:39,000
was a slow, hands on job.
24
00:00:39,000 --> 00:00:41,799
Someone on the IT team would
build a master copy of windows
25
00:00:41,799 --> 00:00:44,119
and load it up with the
company's apps and settings.
26
00:00:44,119 --> 00:00:47,000
Then they would copy that exact
setup onto every machine that
27
00:00:47,000 --> 00:00:47,880
left the building.
28
00:00:47,880 --> 00:00:50,320
That worked fine when every
laptop was the same model.
29
00:00:50,320 --> 00:00:52,600
The moment you had five models
from three different vendors,
30
00:00:52,600 --> 00:00:55,719
though, the master copy started
to fall apart and somebody had
31
00:00:55,719 --> 00:00:57,359
to rebuild it from scratch.
32
00:00:57,359 --> 00:00:59,759
Windows autopilot throws that
whole routine out.
33
00:00:59,759 --> 00:01:02,590
Autopilot doesn't wipe a device
and push a custom copy of
34
00:01:02,590 --> 00:01:03,710
windows onto it.
35
00:01:03,710 --> 00:01:06,230
Instead, it uses the version of
windows that already shipped on
36
00:01:06,230 --> 00:01:08,030
the machine and configures it
from the cloud.
37
00:01:08,030 --> 00:01:10,709
Microsoft describes autopilot as
a collection of technologies
38
00:01:10,709 --> 00:01:13,469
used to set up and pre-configure
new devices, getting them ready
39
00:01:13,469 --> 00:01:14,670
for productive use.
40
00:01:14,670 --> 00:01:17,590
That wording matters because the
goal was never to replace the
41
00:01:17,590 --> 00:01:19,150
windows sitting on the device.
42
00:01:19,150 --> 00:01:20,569
The goal is to turn the factory
43
00:01:20,569 --> 00:01:21,909
version of windows into a
44
00:01:21,909 --> 00:01:23,069
business ready version of
45
00:01:23,069 --> 00:01:23,750
itself.
46
00:01:23,750 --> 00:01:26,269
Business ready is a vague
phrase, so let's unpack it.
47
00:01:26,269 --> 00:01:29,069
It means the device can apply
your organization settings and
48
00:01:29,069 --> 00:01:32,510
policies, install the apps
people need to do their jobs and
49
00:01:32,510 --> 00:01:34,430
even step the addition of
windows up a level.
50
00:01:34,430 --> 00:01:37,349
A device might move from Windows
Pro to Windows Enterprise, so
51
00:01:37,349 --> 00:01:39,629
the company gets the features
it's already paying for.
52
00:01:39,629 --> 00:01:41,670
Autopilot also isn't only for
the first day.
53
00:01:41,670 --> 00:01:44,189
The same idea covers the rest of
a device's life.
54
00:01:44,189 --> 00:01:45,790
It can reset a used machine,
55
00:01:45,790 --> 00:01:47,430
repurpose it for a new person,
56
00:01:47,430 --> 00:01:48,829
and recover it when something
57
00:01:48,829 --> 00:01:49,549
goes wrong.
58
00:01:49,549 --> 00:01:50,590
The same technology sets up
59
00:01:50,590 --> 00:01:51,629
HoloLens two headsets in
60
00:01:51,629 --> 00:01:52,469
addition to laptops and
61
00:01:52,469 --> 00:01:53,189
desktops.
62
00:01:53,189 --> 00:01:54,750
That covers the device's whole
life.
63
00:01:54,750 --> 00:01:56,069
From the first boot to the day
64
00:01:56,069 --> 00:01:57,549
it's retired rather than a
65
00:01:57,549 --> 00:01:58,670
single moment when a box
66
00:01:58,670 --> 00:01:59,310
arrives.
67
00:01:59,310 --> 00:02:01,829
The part that catches people off
guard is how little the end user
68
00:02:01,829 --> 00:02:02,549
has to do.
69
00:02:02,549 --> 00:02:04,989
You connect the device to a
network, you sign in with your
70
00:02:04,989 --> 00:02:06,109
work account and that's it.
71
00:02:06,109 --> 00:02:07,870
Microsoft puts it plainly saying
72
00:02:07,870 --> 00:02:09,189
the only interaction required
73
00:02:09,189 --> 00:02:10,789
from the end user is to connect
74
00:02:10,789 --> 00:02:12,189
to a network and to verify their
75
00:02:12,189 --> 00:02:12,830
credentials.
76
00:02:12,830 --> 00:02:14,909
Everything beyond that point
runs on its own.
77
00:02:14,909 --> 00:02:17,590
That's why the first run setup
feels less like installing
78
00:02:17,590 --> 00:02:20,069
software and more like the
laptop already knew what it was
79
00:02:20,069 --> 00:02:21,150
supposed to become.
80
00:02:21,150 --> 00:02:22,710
Which brings us to the real
mystery.
81
00:02:22,710 --> 00:02:24,150
Nobody re-imaged the device, and
82
00:02:24,150 --> 00:02:25,349
nobody handed it a list of
83
00:02:25,349 --> 00:02:26,150
instructions.
84
00:02:26,150 --> 00:02:28,469
Yet somehow it knew it belonged
to your company the first time
85
00:02:28,469 --> 00:02:29,629
it woke up.
86
00:02:29,629 --> 00:02:32,349
The answer sits in a step most
people skip right past, and it's
87
00:02:32,349 --> 00:02:34,830
where the real trick of
autopilot is hiding.
88
00:02:34,830 --> 00:02:36,590
Why it teams made the switch.
89
00:02:36,590 --> 00:02:38,030
There's a reason this caught on,
90
00:02:38,030 --> 00:02:39,150
and it's less flashy than the
91
00:02:39,150 --> 00:02:39,669
demo.
92
00:02:39,669 --> 00:02:41,270
Microsoft frames autopilot as
93
00:02:41,270 --> 00:02:42,949
reducing the time it spends
94
00:02:42,949 --> 00:02:44,110
deploying, managing, and
95
00:02:44,110 --> 00:02:45,430
retiring devices.
96
00:02:45,430 --> 00:02:47,710
It also cuts down the
infrastructure required to keep
97
00:02:47,710 --> 00:02:50,710
those devices running, and it
makes life easier for every kind
98
00:02:50,710 --> 00:02:51,430
of end user.
99
00:02:51,430 --> 00:02:52,750
Read those three together and
100
00:02:52,750 --> 00:02:54,030
you have the whole pitch in a
101
00:02:54,030 --> 00:02:54,509
breath.
102
00:02:54,509 --> 00:02:57,430
The infrastructure part is the
piece people underestimate.
103
00:02:57,430 --> 00:02:58,550
The old way often meant a
104
00:02:58,550 --> 00:03:00,069
server, a set of images, and a
105
00:03:00,069 --> 00:03:01,419
driver pack for each model you
106
00:03:01,419 --> 00:03:02,020
supported.
107
00:03:02,020 --> 00:03:04,780
Every one of those things had to
be kept alive, patched, and
108
00:03:04,780 --> 00:03:06,259
updated with autopilot.
109
00:03:06,259 --> 00:03:08,939
The device arrives with windows
already on it and the setup
110
00:03:08,939 --> 00:03:11,620
happens in the cloud, so there's
far less machinery sitting in a
111
00:03:11,620 --> 00:03:12,620
closet waiting to break.
112
00:03:12,620 --> 00:03:13,860
There's a human benefit too, and
113
00:03:13,860 --> 00:03:14,939
it's the one your coworkers
114
00:03:14,939 --> 00:03:15,500
notice first.
115
00:03:15,500 --> 00:03:17,979
When a company hires someone
new, that person's laptop can
116
00:03:17,979 --> 00:03:18,900
show up ready to go.
117
00:03:18,900 --> 00:03:20,060
So setup becomes a sign in
118
00:03:20,060 --> 00:03:21,120
instead of a trip to the IT
119
00:03:21,120 --> 00:03:21,699
desk.
120
00:03:21,699 --> 00:03:24,139
Multiply that across one hundred
hires a year and the math starts
121
00:03:24,139 --> 00:03:25,219
to speak for itself.
122
00:03:25,219 --> 00:03:28,259
It's not that it stops working
and that point matters.
123
00:03:28,259 --> 00:03:29,500
The work shifts from standing
124
00:03:29,500 --> 00:03:31,319
over machines with a USB stick,
125
00:03:31,319 --> 00:03:32,539
to defining the settings and
126
00:03:32,539 --> 00:03:33,620
apps that every device should
127
00:03:33,620 --> 00:03:34,340
receive.
128
00:03:34,340 --> 00:03:35,580
The labor moves upstream where
129
00:03:35,580 --> 00:03:36,819
you do it once, and it applies
130
00:03:36,819 --> 00:03:38,340
to every device that follows,
131
00:03:38,340 --> 00:03:39,620
which is a very different kind
132
00:03:39,620 --> 00:03:40,340
of job.
133
00:03:40,340 --> 00:03:42,860
None of that works, though,
without one small step that
134
00:03:42,860 --> 00:03:45,419
happens long before a device is
ever switched on.
135
00:03:46,419 --> 00:03:48,860
How a device gets claimed the
hardware hash.
136
00:03:48,860 --> 00:03:50,060
Before any device can deploy
137
00:03:50,060 --> 00:03:51,460
with autopilot, it has to be
138
00:03:51,460 --> 00:03:53,020
registered, and registration is
139
00:03:53,020 --> 00:03:54,099
the step that makes everything
140
00:03:54,099 --> 00:03:55,020
else possible.
141
00:03:55,020 --> 00:03:56,259
Two things have to happen.
142
00:03:56,259 --> 00:03:59,139
The device's unique hardware
identity, called a hardware
143
00:03:59,139 --> 00:04:02,129
hash, gets captured and uploaded
to the autopilot service.
144
00:04:02,129 --> 00:04:04,729
Then the device gets tied to
your organization space in
145
00:04:04,729 --> 00:04:07,969
Microsoft's Cloud, which people
usually call your tenant.
146
00:04:07,969 --> 00:04:09,050
A hardware hash sounds
147
00:04:09,050 --> 00:04:10,210
technical, but it's really just
148
00:04:10,210 --> 00:04:10,969
a fingerprint.
149
00:04:10,969 --> 00:04:12,210
It's built from details like the
150
00:04:12,210 --> 00:04:13,409
manufacturer, the model, the
151
00:04:13,409 --> 00:04:14,969
device serial number, and the
152
00:04:14,969 --> 00:04:16,470
serial number of the hard drive,
153
00:04:16,470 --> 00:04:17,529
along with a handful of other
154
00:04:17,529 --> 00:04:18,610
traits that together make the
155
00:04:18,610 --> 00:04:19,889
machine recognizable.
156
00:04:19,889 --> 00:04:21,930
Here's a detail that surprises
almost everyone.
157
00:04:21,930 --> 00:04:23,170
The hash changes every time it's
158
00:04:23,170 --> 00:04:24,370
generated because it includes
159
00:04:24,370 --> 00:04:25,930
the moment it was created, yet
160
00:04:25,930 --> 00:04:27,089
the service can still match the
161
00:04:27,089 --> 00:04:28,810
device anyway, even after
162
00:04:28,810 --> 00:04:29,930
something like a hard drive
163
00:04:29,930 --> 00:04:31,410
swap.
164
00:04:31,410 --> 00:04:34,089
A motherboard replacement is the
one thing that breaks the match,
165
00:04:34,089 --> 00:04:36,529
and then someone has to generate
and upload a fresh hash.
166
00:04:36,529 --> 00:04:37,649
The move that makes autopilot
167
00:04:37,649 --> 00:04:39,089
feel like magic is who does this
168
00:04:39,089 --> 00:04:39,610
work.
169
00:04:39,610 --> 00:04:40,889
Ideally, the company you bought
170
00:04:40,889 --> 00:04:41,850
the device from, the
171
00:04:41,850 --> 00:04:43,290
manufacturer or the reseller
172
00:04:43,290 --> 00:04:44,490
registers it before it ever
173
00:04:44,490 --> 00:04:44,930
ships.
174
00:04:44,930 --> 00:04:46,050
The laptop then leaves the
175
00:04:46,050 --> 00:04:47,329
factory already tied to your
176
00:04:47,329 --> 00:04:48,209
organization.
177
00:04:48,209 --> 00:04:50,250
Nobody at your company opened a
box.
178
00:04:50,250 --> 00:04:52,009
Nobody touched the machine, and
179
00:04:52,009 --> 00:04:53,009
it already knows where it
180
00:04:53,009 --> 00:04:53,689
belongs.
181
00:04:53,689 --> 00:04:55,050
If the vendor doesn't do it, an
182
00:04:55,050 --> 00:04:56,569
admin can register devices by
183
00:04:56,569 --> 00:04:57,089
hand.
184
00:04:57,089 --> 00:04:59,209
That usually means collecting
the hardware hashes and
185
00:04:59,209 --> 00:05:01,879
uploading them in a file, which
is slower but works fine for a
186
00:05:01,879 --> 00:05:02,920
handful of machines.
187
00:05:02,920 --> 00:05:04,240
There's also a quiet side effect
188
00:05:04,240 --> 00:05:05,600
registering a device creates an
189
00:05:05,600 --> 00:05:06,600
object for it in your cloud
190
00:05:06,600 --> 00:05:07,319
directory.
191
00:05:07,319 --> 00:05:09,680
The device uses that object to
prove who it is before any
192
00:05:09,680 --> 00:05:10,879
person has signed in.
193
00:05:10,879 --> 00:05:13,600
That object is the reason a
brand new machine can show your
194
00:05:13,600 --> 00:05:15,959
company's name and logo on the
very first screen.
195
00:05:15,959 --> 00:05:18,680
Now the device is claimed and it
knows it belongs to you.
196
00:05:18,680 --> 00:05:19,879
Knowing who owns it isn't the
197
00:05:19,879 --> 00:05:20,839
same as knowing what it should
198
00:05:20,839 --> 00:05:21,920
become, though, and that's the
199
00:05:21,920 --> 00:05:23,480
job of the next piece the
200
00:05:23,480 --> 00:05:25,759
deployment profile, deployment
201
00:05:25,759 --> 00:05:27,040
profiles, the instructions the
202
00:05:27,040 --> 00:05:28,279
device follows.
203
00:05:28,279 --> 00:05:29,639
A registered device still needs
204
00:05:29,639 --> 00:05:30,800
instructions, and those
205
00:05:30,800 --> 00:05:31,920
instructions come from a
206
00:05:31,920 --> 00:05:33,120
deployment profile.
207
00:05:33,120 --> 00:05:35,560
Picture the profile as a short
list of decisions about the
208
00:05:35,560 --> 00:05:36,800
first run experience.
209
00:05:36,800 --> 00:05:38,839
It answers questions like
whether this device is meant for
210
00:05:38,839 --> 00:05:41,360
one person or for many, and
whether the sign in screen
211
00:05:41,360 --> 00:05:43,639
should carry the organization's
name and logo.
212
00:05:43,639 --> 00:05:46,480
It also decides whether the
setup skips certain screens that
213
00:05:46,480 --> 00:05:47,879
nobody ever needs to see.
214
00:05:47,879 --> 00:05:50,680
The profile gets assigned to the
device, and in most setups, that
215
00:05:50,680 --> 00:05:53,040
assignment happens automatically
through a device group.
216
00:05:53,040 --> 00:05:55,160
So nobody has to place each
machine by hand.
217
00:05:55,160 --> 00:05:56,319
When the device boots for the
218
00:05:56,319 --> 00:05:57,480
first time and connects to the
219
00:05:57,480 --> 00:05:58,759
network, it reaches out and
220
00:05:58,759 --> 00:06:00,199
pulls its profile down from the
221
00:06:00,199 --> 00:06:00,839
cloud.
222
00:06:00,839 --> 00:06:02,720
Then it follows that profile
step by step.
223
00:06:02,720 --> 00:06:03,839
A device that somehow ends up
224
00:06:03,839 --> 00:06:05,120
with no profile assigned doesn't
225
00:06:05,120 --> 00:06:05,720
simply break.
226
00:06:05,720 --> 00:06:08,240
It falls back to a default
profile, which matters the next
227
00:06:08,240 --> 00:06:10,560
time a machine behaves
differently from its neighbors.
228
00:06:10,560 --> 00:06:11,759
There's a second screen you
229
00:06:11,759 --> 00:06:13,079
should know about because it's
230
00:06:13,079 --> 00:06:14,259
the one people actually see
231
00:06:14,259 --> 00:06:15,079
during setup.
232
00:06:15,079 --> 00:06:17,480
It's called the enrollment
status page, which is really
233
00:06:17,480 --> 00:06:19,240
just a setup progress screen.
234
00:06:19,240 --> 00:06:20,439
While the device is applying
235
00:06:20,439 --> 00:06:22,040
settings and installing apps,
236
00:06:22,040 --> 00:06:23,519
this screen holds the user in
237
00:06:23,519 --> 00:06:24,899
place and shows how far along
238
00:06:24,899 --> 00:06:25,439
things are.
239
00:06:25,439 --> 00:06:26,759
Nobody lands on a half finished
240
00:06:26,759 --> 00:06:27,839
desktop and starts clicking
241
00:06:27,839 --> 00:06:28,879
around before the machine is
242
00:06:28,879 --> 00:06:29,600
ready.
243
00:06:29,600 --> 00:06:32,160
The profile is the recipe, and
the progress screen is the
244
00:06:32,160 --> 00:06:35,199
kitchen timer that stops you
from opening the oven too early.
245
00:06:35,199 --> 00:06:36,399
At this point, the device has an
246
00:06:36,399 --> 00:06:37,360
identity and a set of
247
00:06:37,360 --> 00:06:38,240
instructions.
248
00:06:38,240 --> 00:06:40,480
The last piece is the one
beginner's trip over.
249
00:06:40,480 --> 00:06:41,920
It involves two products with
250
00:06:41,920 --> 00:06:42,920
names that don't explain
251
00:06:42,920 --> 00:06:44,240
themselves, and those two
252
00:06:44,240 --> 00:06:45,839
products do two very different
253
00:06:45,839 --> 00:06:46,720
jobs.
254
00:06:46,720 --> 00:06:49,959
Joining the organization intra
join and Intune.
255
00:06:49,959 --> 00:06:53,160
The device needs two things from
your organization a place in the
256
00:06:53,160 --> 00:06:54,360
directory and a manager.
257
00:06:54,360 --> 00:06:55,959
The directory is Microsoft entry
258
00:06:55,959 --> 00:06:57,560
ID, which you can think of as
259
00:06:57,560 --> 00:06:59,040
the address book of every person
260
00:06:59,040 --> 00:07:00,394
and every device your company
261
00:07:00,394 --> 00:07:01,110
trusts.
262
00:07:01,110 --> 00:07:04,550
The manager is Microsoft Intune,
the tool it uses to look after
263
00:07:04,550 --> 00:07:06,069
devices after they're set up.
264
00:07:06,069 --> 00:07:07,589
Pushing settings, apps, and
265
00:07:07,589 --> 00:07:08,829
security rules to them over
266
00:07:08,829 --> 00:07:09,389
time.
267
00:07:09,389 --> 00:07:12,430
Joining the directory is called
an intra join, and it's simpler
268
00:07:12,430 --> 00:07:13,350
than it sounds.
269
00:07:13,350 --> 00:07:14,389
The device stops being a
270
00:07:14,389 --> 00:07:16,009
stranger and becomes a known,
271
00:07:16,009 --> 00:07:17,470
trusted member of that address
272
00:07:17,470 --> 00:07:17,709
book.
273
00:07:17,709 --> 00:07:20,269
The moment it joins that join
automatically triggers
274
00:07:20,269 --> 00:07:21,670
enrollment into Intune.
275
00:07:21,670 --> 00:07:22,870
That's the hand-off that gets
276
00:07:22,870 --> 00:07:24,069
the device, its apps, and its
277
00:07:24,069 --> 00:07:24,589
settings.
278
00:07:24,589 --> 00:07:27,149
And you don't have to flip a
second switch because the join
279
00:07:27,149 --> 00:07:28,310
itself is the trigger.
280
00:07:28,310 --> 00:07:30,550
This is the boundary that
confuses people the most.
281
00:07:30,550 --> 00:07:32,189
So it's worth saying plainly.
282
00:07:32,189 --> 00:07:34,910
Autopilot handles the first run
setup, and Intune handles
283
00:07:34,910 --> 00:07:37,509
everything that comes after the
two work together, but they
284
00:07:37,509 --> 00:07:38,709
aren't the same thing.
285
00:07:38,709 --> 00:07:41,829
Autopilot gets the device to the
starting line and Intune runs
286
00:07:41,829 --> 00:07:42,949
the race from there.
287
00:07:42,949 --> 00:07:45,069
One more join option might come
up in your reading, and it's
288
00:07:45,069 --> 00:07:46,709
called intra Hybrid Join.
289
00:07:46,709 --> 00:07:49,389
It keeps the connection to the
older on premises servers that
290
00:07:49,389 --> 00:07:50,870
some organizations still run.
291
00:07:50,870 --> 00:07:51,990
Not every company has moved
292
00:07:51,990 --> 00:07:53,149
fully to the cloud, and for
293
00:07:53,149 --> 00:07:54,430
some, this is the only path that
294
00:07:54,430 --> 00:07:54,990
fits.
295
00:07:54,990 --> 00:07:56,269
Microsoft's own guidance,
296
00:07:56,269 --> 00:07:58,110
though, is to set up new devices
297
00:07:58,110 --> 00:07:59,629
as cloud native with a plain
298
00:07:59,629 --> 00:08:00,980
intra join, since that gives the
299
00:08:00,980 --> 00:08:02,379
smoothest experience.
300
00:08:02,379 --> 00:08:03,819
Hybrid join stays mostly for the
301
00:08:03,819 --> 00:08:05,220
devices that already depend on
302
00:08:05,220 --> 00:08:05,620
it.
303
00:08:05,620 --> 00:08:08,019
That's the whole machine a
device gets claimed by its
304
00:08:08,019 --> 00:08:10,180
hardware hash, gets its
instructions from a profile,
305
00:08:10,180 --> 00:08:13,459
joins the directory, and hands
off to Intune for the long haul.
306
00:08:13,459 --> 00:08:15,019
The deployment modes just change
307
00:08:15,019 --> 00:08:16,420
who runs that same machine,
308
00:08:16,420 --> 00:08:17,740
depending on who happens to be
309
00:08:17,740 --> 00:08:18,259
standing there.
310
00:08:18,259 --> 00:08:19,899
When the box opens.
311
00:08:19,899 --> 00:08:21,500
The deployment modes explained
312
00:08:21,500 --> 00:08:22,779
simply, the modes aren't
313
00:08:22,779 --> 00:08:23,579
different products.
314
00:08:23,579 --> 00:08:24,579
There are different ways to run
315
00:08:24,579 --> 00:08:26,540
the same setup, and you pick one
316
00:08:26,540 --> 00:08:28,060
based on the situation in front
317
00:08:28,060 --> 00:08:28,420
of you.
318
00:08:28,420 --> 00:08:30,100
A few of them matter more than
the rest.
319
00:08:30,100 --> 00:08:31,699
User driven mode is the default.
320
00:08:31,699 --> 00:08:32,860
You probably picture.
321
00:08:32,860 --> 00:08:33,980
The device is meant for one
322
00:08:33,980 --> 00:08:35,740
person and that person runs the
323
00:08:35,740 --> 00:08:36,779
setup themselves.
324
00:08:36,779 --> 00:08:39,340
It's the right choice when a
laptop ships straight to an
325
00:08:39,340 --> 00:08:42,179
employee's home, and it even
works on virtual machines, the
326
00:08:42,179 --> 00:08:43,259
trade off is time.
327
00:08:43,259 --> 00:08:44,460
The user sits through both the
328
00:08:44,460 --> 00:08:45,860
device setup and their own
329
00:08:45,860 --> 00:08:47,460
account setup, and that can take
330
00:08:47,460 --> 00:08:48,059
a while.
331
00:08:48,059 --> 00:08:50,539
If you've ever waited on a new
work laptop while it churned
332
00:08:50,539 --> 00:08:53,379
through setup screens, you were
watching this mode do its job.
333
00:08:53,379 --> 00:08:54,679
Pre-provisioned mode splits the
334
00:08:54,679 --> 00:08:55,779
work, and it used to be called
335
00:08:55,779 --> 00:08:56,940
White glove.
336
00:08:56,940 --> 00:09:00,139
A technician or the vendor runs
the slow first half of the setup
337
00:09:00,139 --> 00:09:02,340
and then seals the device back
up and ships it.
338
00:09:02,340 --> 00:09:03,899
When the user finally opens it,
339
00:09:03,899 --> 00:09:05,580
they only finish a short flow,
340
00:09:05,580 --> 00:09:06,960
so their setup time drops to
341
00:09:06,960 --> 00:09:07,500
minutes.
342
00:09:07,500 --> 00:09:10,100
The catch is that it needs a
security chip called a TPM short
343
00:09:10,100 --> 00:09:11,779
for Trusted Platform module.
344
00:09:11,779 --> 00:09:14,659
That's a small chip inside the
device that can prove the
345
00:09:14,659 --> 00:09:15,700
machine is genuine.
346
00:09:15,700 --> 00:09:17,139
That means physical devices only
347
00:09:17,139 --> 00:09:18,100
with no virtual machines
348
00:09:18,100 --> 00:09:18,899
allowed.
349
00:09:18,899 --> 00:09:20,259
Self-deploying mode takes the
350
00:09:20,259 --> 00:09:21,259
user out of the picture
351
00:09:21,259 --> 00:09:21,899
entirely.
352
00:09:21,899 --> 00:09:24,899
The device sets itself up with
little to no interaction, which
353
00:09:24,899 --> 00:09:28,220
makes it perfect for a kiosk, a
digital signage screen, or a
354
00:09:28,220 --> 00:09:30,620
shared device that a lot of
people will use.
355
00:09:30,620 --> 00:09:32,059
It also needs that TPM chip.
356
00:09:32,059 --> 00:09:33,820
So again, no virtual machines.
357
00:09:33,820 --> 00:09:35,379
And because no user is involved,
358
00:09:35,379 --> 00:09:36,940
you can't assign the device to a
359
00:09:36,940 --> 00:09:38,059
specific person.
360
00:09:38,059 --> 00:09:40,779
Two more names are worth knowing
so they don't confuse you later.
361
00:09:40,779 --> 00:09:43,700
Autopilot for existing devices
isn't really a mode of its own.
362
00:09:43,700 --> 00:09:44,899
It's a way to put a fresh copy
363
00:09:44,899 --> 00:09:46,100
of windows onto a machine that
364
00:09:46,100 --> 00:09:47,340
needs one, then hand that
365
00:09:47,340 --> 00:09:48,220
machine off to a normal
366
00:09:48,220 --> 00:09:49,379
autopilot run.
367
00:09:49,379 --> 00:09:50,740
It leans on Microsoft's older
368
00:09:50,740 --> 00:09:52,059
device management tool to do the
369
00:09:52,059 --> 00:09:53,220
heavy lifting.
370
00:09:53,220 --> 00:09:54,860
Autopilot reset is the reset
371
00:09:54,860 --> 00:09:56,259
button, which takes a device
372
00:09:56,259 --> 00:09:57,779
that's already registered and
373
00:09:57,779 --> 00:09:58,940
sends it back to a business
374
00:09:58,940 --> 00:09:59,779
ready state.
375
00:09:59,779 --> 00:10:03,210
Handy when a laptop changes
hands or needs a clean start.
376
00:10:03,210 --> 00:10:04,490
One practical detail about
377
00:10:04,490 --> 00:10:05,830
Pre-provisioning catches people
378
00:10:05,830 --> 00:10:06,610
off guard.
379
00:10:06,610 --> 00:10:08,389
Microsoft recommends waiting at
380
00:10:08,389 --> 00:10:09,610
least ninety minutes between the
381
00:10:09,610 --> 00:10:10,929
technician's half of the setup
382
00:10:10,929 --> 00:10:12,129
and the user's half, so the
383
00:10:12,129 --> 00:10:13,330
security tokens have time to
384
00:10:13,330 --> 00:10:14,169
refresh.
385
00:10:14,169 --> 00:10:15,169
The users half should also
386
00:10:15,169 --> 00:10:16,409
finish within six months of the
387
00:10:16,409 --> 00:10:17,450
technician's work.
388
00:10:17,450 --> 00:10:18,570
Missed that second window and
389
00:10:18,570 --> 00:10:19,809
the certificates can expire,
390
00:10:19,809 --> 00:10:21,049
which shows up later as setup
391
00:10:21,049 --> 00:10:21,690
errors.
392
00:10:21,690 --> 00:10:23,289
Speaking of how autopilot looks
393
00:10:23,289 --> 00:10:24,929
today, there's a newer, simpler
394
00:10:24,929 --> 00:10:26,389
flavor that Microsoft now points
395
00:10:26,389 --> 00:10:27,970
people toward, and it changes a
396
00:10:27,970 --> 00:10:28,970
few of the rules we just
397
00:10:28,970 --> 00:10:29,809
covered.
398
00:10:29,809 --> 00:10:31,490
The newer, simpler flavor
399
00:10:31,490 --> 00:10:32,850
autopilot today comes in two
400
00:10:32,850 --> 00:10:33,409
flavors.
401
00:10:33,409 --> 00:10:36,169
The one we've been describing is
the classic version, and there's
402
00:10:36,169 --> 00:10:39,049
a newer one called Windows
Autopilot Device Preparation.
403
00:10:39,049 --> 00:10:41,450
The idea behind the newer one is
to keep the good parts and
404
00:10:41,450 --> 00:10:42,730
remove the fiddly parts.
405
00:10:42,730 --> 00:10:45,289
The biggest change is that it
doesn't ask you to pre-stage
406
00:10:45,289 --> 00:10:46,129
devices at all.
407
00:10:46,129 --> 00:10:48,730
Instead of registering every
machine ahead of time, the
408
00:10:48,730 --> 00:10:51,690
device gets grouped the moment
it enrolls and configured right
409
00:10:51,690 --> 00:10:55,090
then, which cuts out an entire
preparation step that used to
410
00:10:55,090 --> 00:10:55,889
trip people up.
411
00:10:55,889 --> 00:10:58,009
There's no hardware hash to
chase down first.
412
00:10:58,009 --> 00:10:59,850
What you give up is some
flexibility.
413
00:10:59,850 --> 00:11:02,559
Device preparation supports a
plain Android join only, so no
414
00:11:02,559 --> 00:11:04,879
hybrid join, and it runs on
windows eleven only.
415
00:11:04,879 --> 00:11:07,399
It can deliver fewer apps and
scripts during setup than the
416
00:11:07,399 --> 00:11:09,799
classic version, and it doesn't
offer Pre-provisioning or
417
00:11:09,799 --> 00:11:10,960
Self-deploying at all.
418
00:11:10,960 --> 00:11:12,960
What you gain is simplicity and
speed.
419
00:11:12,960 --> 00:11:14,240
There's one policy to configure
420
00:11:14,240 --> 00:11:15,840
instead of several moving parts,
421
00:11:15,840 --> 00:11:17,159
and the setup experience is more
422
00:11:17,159 --> 00:11:17,919
consistent.
423
00:11:17,919 --> 00:11:19,299
The reporting is also close to
424
00:11:19,299 --> 00:11:20,639
real time, so when something
425
00:11:20,639 --> 00:11:21,679
goes wrong, you can see where
426
00:11:21,679 --> 00:11:22,440
it's stuck.
427
00:11:22,440 --> 00:11:25,200
For a beginner, the honest
summary is this classic
428
00:11:25,200 --> 00:11:28,320
autopilot gives you more options
and more control, while device
429
00:11:28,320 --> 00:11:31,440
preparation gives you fewer
knobs, a faster setup, and a
430
00:11:31,440 --> 00:11:33,080
clearer view of what happened.
431
00:11:33,080 --> 00:11:36,159
Both are autopilot, and plenty
of organizations run them side
432
00:11:36,159 --> 00:11:39,519
by side before you assume it
always works, though, it helps
433
00:11:39,519 --> 00:11:43,440
to know where it can trip you
up, where it can trip you up.
434
00:11:43,440 --> 00:11:45,320
Autopilot still needs the
internet during setup.
435
00:11:45,320 --> 00:11:47,759
That sounds obvious, but it
means a device that can't reach
436
00:11:47,759 --> 00:11:50,360
the network, can't finish a
brand new laptop.
437
00:11:50,360 --> 00:11:51,500
Sitting in a warehouse with no
438
00:11:51,500 --> 00:11:53,340
Wi-Fi stays stuck until it gets
439
00:11:53,340 --> 00:11:54,120
a connection.
440
00:11:54,120 --> 00:11:56,679
During setup, the device is
talking to Microsoft's cloud
441
00:11:56,679 --> 00:11:59,360
services the whole time, which
is why a solid network
442
00:11:59,360 --> 00:12:01,029
connection isn't optional.
443
00:12:01,029 --> 00:12:02,350
The TPM requirement narrows
444
00:12:02,350 --> 00:12:03,389
things down more than people
445
00:12:03,389 --> 00:12:03,950
expect.
446
00:12:03,950 --> 00:12:06,029
Pre-provisioning and
Self-deploying both need that
447
00:12:06,029 --> 00:12:08,830
security chip, so virtual
machines won't work for either
448
00:12:08,830 --> 00:12:12,029
one, even when the virtual
machine has a virtual TPM.
449
00:12:12,029 --> 00:12:13,470
If your team does a lot of its
450
00:12:13,470 --> 00:12:14,870
testing in virtual machines,
451
00:12:14,870 --> 00:12:16,350
that's a real limitation to plan
452
00:12:16,350 --> 00:12:16,789
around.
453
00:12:16,789 --> 00:12:19,789
Hybrid join adds its own wrinkle
if a device needs to join both
454
00:12:19,789 --> 00:12:22,629
the cloud and an older on
premises domain, it also needs a
455
00:12:22,629 --> 00:12:24,710
connection to a domain
controller during setup.
456
00:12:24,710 --> 00:12:25,870
For a fully remote employee,
457
00:12:25,870 --> 00:12:27,309
that's often a deal breaker, and
458
00:12:27,309 --> 00:12:28,610
it's one more reason Microsoft
459
00:12:28,610 --> 00:12:30,110
nudges new devices toward a
460
00:12:30,110 --> 00:12:30,350
plane.
461
00:12:30,350 --> 00:12:31,830
Cloud join licensing is real,
462
00:12:31,830 --> 00:12:32,950
and it's the part beginners
463
00:12:32,950 --> 00:12:33,590
skip.
464
00:12:33,590 --> 00:12:36,389
Autopilot rides on the directory
and device management features
465
00:12:36,389 --> 00:12:38,470
that come with subscriptions
like Microsoft three hundred
466
00:12:38,470 --> 00:12:41,750
sixty five Business Premium, or
the E3 and E5 plans.
467
00:12:41,750 --> 00:12:44,549
Those licenses have to be
assigned to actual people before
468
00:12:44,549 --> 00:12:45,990
their devices can enroll.
469
00:12:45,990 --> 00:12:48,590
A license sitting unused in a
spreadsheet does nothing for the
470
00:12:48,590 --> 00:12:49,830
laptop on the desk.
471
00:12:49,830 --> 00:12:51,470
There's a registration gotcha
too.
472
00:12:51,470 --> 00:12:53,830
If someone deletes the devices
object in the directory,
473
00:12:53,830 --> 00:12:54,990
enrollment can fail.
474
00:12:54,990 --> 00:12:56,309
On top of that, a device that
475
00:12:56,309 --> 00:12:57,669
went through Pre-provisioning
476
00:12:57,669 --> 00:12:59,149
can't simply re-enroll itself
477
00:12:59,149 --> 00:13:00,850
after the first deployment to
478
00:13:00,850 --> 00:13:02,169
run it again, an admin has to
479
00:13:02,169 --> 00:13:03,350
delete the device record and
480
00:13:03,350 --> 00:13:04,110
start over.
481
00:13:04,110 --> 00:13:05,590
None of this is a deal breaker.
482
00:13:05,590 --> 00:13:08,190
It's just the difference between
a setup that just works and a
483
00:13:08,190 --> 00:13:10,870
laptop sitting on a progress
screen at nine in the morning.
484
00:13:10,870 --> 00:13:12,789
Knowing the limits is what
separates someone who
485
00:13:12,789 --> 00:13:15,909
understands autopilot from
someone who has only memorized
486
00:13:15,909 --> 00:13:17,750
the marketing recap.
487
00:13:17,750 --> 00:13:19,149
And one question for you.
488
00:13:19,149 --> 00:13:20,470
So let's pull it together.
489
00:13:20,470 --> 00:13:23,909
Windows autopilot is cloud based
setup for new windows devices.
490
00:13:23,909 --> 00:13:26,490
A device gets claimed by its
hardware hash, told what to
491
00:13:26,490 --> 00:13:29,789
become by a deployment profile,
given an identity by entry ID,
492
00:13:29,789 --> 00:13:31,909
and managed afterward by Intune.
493
00:13:31,909 --> 00:13:33,269
The modes just change who does
494
00:13:33,269 --> 00:13:35,070
the setup, and the newer device
495
00:13:35,070 --> 00:13:36,470
preparation flavor trades some
496
00:13:36,470 --> 00:13:37,669
flexibility for speed and
497
00:13:37,669 --> 00:13:38,509
simplicity.
498
00:13:38,509 --> 00:13:39,789
The one idea underneath all of
499
00:13:39,789 --> 00:13:41,470
it is this the laptop belongs to
500
00:13:41,470 --> 00:13:42,669
your organization before anyone
501
00:13:42,669 --> 00:13:43,950
opens the box, and that's the
502
00:13:43,950 --> 00:13:45,190
whole reason it can set itself
503
00:13:45,190 --> 00:13:45,669
up.
504
00:13:45,669 --> 00:13:47,110
So here's a question worth
sitting with.
505
00:13:47,110 --> 00:13:49,470
If a device can be trusted and
ready from the moment it's
506
00:13:49,470 --> 00:13:52,309
built, what does that change
about how your team thinks about
507
00:13:52,309 --> 00:13:53,950
bringing a new person on board?
508
00:13:53,950 --> 00:13:56,429
If this made autopilot feel a
little less mysterious,
509
00:13:56,429 --> 00:13:59,990
subscribe to M365 FM to master
the tools and the mindset
510
00:13:59,990 --> 00:14:01,470
shaping the future of work.
00:00:00,040 --> 00:00:01,320
Imagine unboxing a brand new
2
00:00:01,320 --> 00:00:02,680
work laptop and watching it set
3
00:00:02,680 --> 00:00:03,680
itself up for your company
4
00:00:03,680 --> 00:00:04,879
without an IT person in the
5
00:00:04,879 --> 00:00:05,280
room.
6
00:00:05,280 --> 00:00:07,820
That's the promise behind
Windows Autopilot, and it's why
7
00:00:07,820 --> 00:00:10,720
a new hire can be productive on
day one instead of day five.
8
00:00:10,720 --> 00:00:11,660
We're going to break down what
9
00:00:11,660 --> 00:00:13,400
autopilot actually is, how a
10
00:00:13,400 --> 00:00:14,560
device gets claimed by your
11
00:00:14,560 --> 00:00:15,800
organization before it's even
12
00:00:15,800 --> 00:00:16,480
unboxed.
13
00:00:16,480 --> 00:00:18,640
And the one idea that makes the
whole thing work.
14
00:00:18,640 --> 00:00:22,600
Welcome to the M365 FM podcast,
where we explore the people,
15
00:00:22,600 --> 00:00:25,079
ideas, and technologies shaping
the future of work.
16
00:00:25,079 --> 00:00:26,760
If the words hardware, hash and
17
00:00:26,760 --> 00:00:28,039
deployment profile have ever
18
00:00:28,039 --> 00:00:29,559
sounded like a foreign language,
19
00:00:29,559 --> 00:00:31,000
this is the episode that fixes
20
00:00:31,000 --> 00:00:31,719
that.
21
00:00:31,719 --> 00:00:33,920
What autopilot actually is.
22
00:00:33,920 --> 00:00:37,280
For most of the last twenty
years, handing out a new laptop
23
00:00:37,280 --> 00:00:39,000
was a slow, hands on job.
24
00:00:39,000 --> 00:00:41,799
Someone on the IT team would
build a master copy of windows
25
00:00:41,799 --> 00:00:44,119
and load it up with the
company's apps and settings.
26
00:00:44,119 --> 00:00:47,000
Then they would copy that exact
setup onto every machine that
27
00:00:47,000 --> 00:00:47,880
left the building.
28
00:00:47,880 --> 00:00:50,320
That worked fine when every
laptop was the same model.
29
00:00:50,320 --> 00:00:52,600
The moment you had five models
from three different vendors,
30
00:00:52,600 --> 00:00:55,719
though, the master copy started
to fall apart and somebody had
31
00:00:55,719 --> 00:00:57,359
to rebuild it from scratch.
32
00:00:57,359 --> 00:00:59,759
Windows autopilot throws that
whole routine out.
33
00:00:59,759 --> 00:01:02,590
Autopilot doesn't wipe a device
and push a custom copy of
34
00:01:02,590 --> 00:01:03,710
windows onto it.
35
00:01:03,710 --> 00:01:06,230
Instead, it uses the version of
windows that already shipped on
36
00:01:06,230 --> 00:01:08,030
the machine and configures it
from the cloud.
37
00:01:08,030 --> 00:01:10,709
Microsoft describes autopilot as
a collection of technologies
38
00:01:10,709 --> 00:01:13,469
used to set up and pre-configure
new devices, getting them ready
39
00:01:13,469 --> 00:01:14,670
for productive use.
40
00:01:14,670 --> 00:01:17,590
That wording matters because the
goal was never to replace the
41
00:01:17,590 --> 00:01:19,150
windows sitting on the device.
42
00:01:19,150 --> 00:01:20,569
The goal is to turn the factory
43
00:01:20,569 --> 00:01:21,909
version of windows into a
44
00:01:21,909 --> 00:01:23,069
business ready version of
45
00:01:23,069 --> 00:01:23,750
itself.
46
00:01:23,750 --> 00:01:26,269
Business ready is a vague
phrase, so let's unpack it.
47
00:01:26,269 --> 00:01:29,069
It means the device can apply
your organization settings and
48
00:01:29,069 --> 00:01:32,510
policies, install the apps
people need to do their jobs and
49
00:01:32,510 --> 00:01:34,430
even step the addition of
windows up a level.
50
00:01:34,430 --> 00:01:37,349
A device might move from Windows
Pro to Windows Enterprise, so
51
00:01:37,349 --> 00:01:39,629
the company gets the features
it's already paying for.
52
00:01:39,629 --> 00:01:41,670
Autopilot also isn't only for
the first day.
53
00:01:41,670 --> 00:01:44,189
The same idea covers the rest of
a device's life.
54
00:01:44,189 --> 00:01:45,790
It can reset a used machine,
55
00:01:45,790 --> 00:01:47,430
repurpose it for a new person,
56
00:01:47,430 --> 00:01:48,829
and recover it when something
57
00:01:48,829 --> 00:01:49,549
goes wrong.
58
00:01:49,549 --> 00:01:50,590
The same technology sets up
59
00:01:50,590 --> 00:01:51,629
HoloLens two headsets in
60
00:01:51,629 --> 00:01:52,469
addition to laptops and
61
00:01:52,469 --> 00:01:53,189
desktops.
62
00:01:53,189 --> 00:01:54,750
That covers the device's whole
life.
63
00:01:54,750 --> 00:01:56,069
From the first boot to the day
64
00:01:56,069 --> 00:01:57,549
it's retired rather than a
65
00:01:57,549 --> 00:01:58,670
single moment when a box
66
00:01:58,670 --> 00:01:59,310
arrives.
67
00:01:59,310 --> 00:02:01,829
The part that catches people off
guard is how little the end user
68
00:02:01,829 --> 00:02:02,549
has to do.
69
00:02:02,549 --> 00:02:04,989
You connect the device to a
network, you sign in with your
70
00:02:04,989 --> 00:02:06,109
work account and that's it.
71
00:02:06,109 --> 00:02:07,870
Microsoft puts it plainly saying
72
00:02:07,870 --> 00:02:09,189
the only interaction required
73
00:02:09,189 --> 00:02:10,789
from the end user is to connect
74
00:02:10,789 --> 00:02:12,189
to a network and to verify their
75
00:02:12,189 --> 00:02:12,830
credentials.
76
00:02:12,830 --> 00:02:14,909
Everything beyond that point
runs on its own.
77
00:02:14,909 --> 00:02:17,590
That's why the first run setup
feels less like installing
78
00:02:17,590 --> 00:02:20,069
software and more like the
laptop already knew what it was
79
00:02:20,069 --> 00:02:21,150
supposed to become.
80
00:02:21,150 --> 00:02:22,710
Which brings us to the real
mystery.
81
00:02:22,710 --> 00:02:24,150
Nobody re-imaged the device, and
82
00:02:24,150 --> 00:02:25,349
nobody handed it a list of
83
00:02:25,349 --> 00:02:26,150
instructions.
84
00:02:26,150 --> 00:02:28,469
Yet somehow it knew it belonged
to your company the first time
85
00:02:28,469 --> 00:02:29,629
it woke up.
86
00:02:29,629 --> 00:02:32,349
The answer sits in a step most
people skip right past, and it's
87
00:02:32,349 --> 00:02:34,830
where the real trick of
autopilot is hiding.
88
00:02:34,830 --> 00:02:36,590
Why it teams made the switch.
89
00:02:36,590 --> 00:02:38,030
There's a reason this caught on,
90
00:02:38,030 --> 00:02:39,150
and it's less flashy than the
91
00:02:39,150 --> 00:02:39,669
demo.
92
00:02:39,669 --> 00:02:41,270
Microsoft frames autopilot as
93
00:02:41,270 --> 00:02:42,949
reducing the time it spends
94
00:02:42,949 --> 00:02:44,110
deploying, managing, and
95
00:02:44,110 --> 00:02:45,430
retiring devices.
96
00:02:45,430 --> 00:02:47,710
It also cuts down the
infrastructure required to keep
97
00:02:47,710 --> 00:02:50,710
those devices running, and it
makes life easier for every kind
98
00:02:50,710 --> 00:02:51,430
of end user.
99
00:02:51,430 --> 00:02:52,750
Read those three together and
100
00:02:52,750 --> 00:02:54,030
you have the whole pitch in a
101
00:02:54,030 --> 00:02:54,509
breath.
102
00:02:54,509 --> 00:02:57,430
The infrastructure part is the
piece people underestimate.
103
00:02:57,430 --> 00:02:58,550
The old way often meant a
104
00:02:58,550 --> 00:03:00,069
server, a set of images, and a
105
00:03:00,069 --> 00:03:01,419
driver pack for each model you
106
00:03:01,419 --> 00:03:02,020
supported.
107
00:03:02,020 --> 00:03:04,780
Every one of those things had to
be kept alive, patched, and
108
00:03:04,780 --> 00:03:06,259
updated with autopilot.
109
00:03:06,259 --> 00:03:08,939
The device arrives with windows
already on it and the setup
110
00:03:08,939 --> 00:03:11,620
happens in the cloud, so there's
far less machinery sitting in a
111
00:03:11,620 --> 00:03:12,620
closet waiting to break.
112
00:03:12,620 --> 00:03:13,860
There's a human benefit too, and
113
00:03:13,860 --> 00:03:14,939
it's the one your coworkers
114
00:03:14,939 --> 00:03:15,500
notice first.
115
00:03:15,500 --> 00:03:17,979
When a company hires someone
new, that person's laptop can
116
00:03:17,979 --> 00:03:18,900
show up ready to go.
117
00:03:18,900 --> 00:03:20,060
So setup becomes a sign in
118
00:03:20,060 --> 00:03:21,120
instead of a trip to the IT
119
00:03:21,120 --> 00:03:21,699
desk.
120
00:03:21,699 --> 00:03:24,139
Multiply that across one hundred
hires a year and the math starts
121
00:03:24,139 --> 00:03:25,219
to speak for itself.
122
00:03:25,219 --> 00:03:28,259
It's not that it stops working
and that point matters.
123
00:03:28,259 --> 00:03:29,500
The work shifts from standing
124
00:03:29,500 --> 00:03:31,319
over machines with a USB stick,
125
00:03:31,319 --> 00:03:32,539
to defining the settings and
126
00:03:32,539 --> 00:03:33,620
apps that every device should
127
00:03:33,620 --> 00:03:34,340
receive.
128
00:03:34,340 --> 00:03:35,580
The labor moves upstream where
129
00:03:35,580 --> 00:03:36,819
you do it once, and it applies
130
00:03:36,819 --> 00:03:38,340
to every device that follows,
131
00:03:38,340 --> 00:03:39,620
which is a very different kind
132
00:03:39,620 --> 00:03:40,340
of job.
133
00:03:40,340 --> 00:03:42,860
None of that works, though,
without one small step that
134
00:03:42,860 --> 00:03:45,419
happens long before a device is
ever switched on.
135
00:03:46,419 --> 00:03:48,860
How a device gets claimed the
hardware hash.
136
00:03:48,860 --> 00:03:50,060
Before any device can deploy
137
00:03:50,060 --> 00:03:51,460
with autopilot, it has to be
138
00:03:51,460 --> 00:03:53,020
registered, and registration is
139
00:03:53,020 --> 00:03:54,099
the step that makes everything
140
00:03:54,099 --> 00:03:55,020
else possible.
141
00:03:55,020 --> 00:03:56,259
Two things have to happen.
142
00:03:56,259 --> 00:03:59,139
The device's unique hardware
identity, called a hardware
143
00:03:59,139 --> 00:04:02,129
hash, gets captured and uploaded
to the autopilot service.
144
00:04:02,129 --> 00:04:04,729
Then the device gets tied to
your organization space in
145
00:04:04,729 --> 00:04:07,969
Microsoft's Cloud, which people
usually call your tenant.
146
00:04:07,969 --> 00:04:09,050
A hardware hash sounds
147
00:04:09,050 --> 00:04:10,210
technical, but it's really just
148
00:04:10,210 --> 00:04:10,969
a fingerprint.
149
00:04:10,969 --> 00:04:12,210
It's built from details like the
150
00:04:12,210 --> 00:04:13,409
manufacturer, the model, the
151
00:04:13,409 --> 00:04:14,969
device serial number, and the
152
00:04:14,969 --> 00:04:16,470
serial number of the hard drive,
153
00:04:16,470 --> 00:04:17,529
along with a handful of other
154
00:04:17,529 --> 00:04:18,610
traits that together make the
155
00:04:18,610 --> 00:04:19,889
machine recognizable.
156
00:04:19,889 --> 00:04:21,930
Here's a detail that surprises
almost everyone.
157
00:04:21,930 --> 00:04:23,170
The hash changes every time it's
158
00:04:23,170 --> 00:04:24,370
generated because it includes
159
00:04:24,370 --> 00:04:25,930
the moment it was created, yet
160
00:04:25,930 --> 00:04:27,089
the service can still match the
161
00:04:27,089 --> 00:04:28,810
device anyway, even after
162
00:04:28,810 --> 00:04:29,930
something like a hard drive
163
00:04:29,930 --> 00:04:31,410
swap.
164
00:04:31,410 --> 00:04:34,089
A motherboard replacement is the
one thing that breaks the match,
165
00:04:34,089 --> 00:04:36,529
and then someone has to generate
and upload a fresh hash.
166
00:04:36,529 --> 00:04:37,649
The move that makes autopilot
167
00:04:37,649 --> 00:04:39,089
feel like magic is who does this
168
00:04:39,089 --> 00:04:39,610
work.
169
00:04:39,610 --> 00:04:40,889
Ideally, the company you bought
170
00:04:40,889 --> 00:04:41,850
the device from, the
171
00:04:41,850 --> 00:04:43,290
manufacturer or the reseller
172
00:04:43,290 --> 00:04:44,490
registers it before it ever
173
00:04:44,490 --> 00:04:44,930
ships.
174
00:04:44,930 --> 00:04:46,050
The laptop then leaves the
175
00:04:46,050 --> 00:04:47,329
factory already tied to your
176
00:04:47,329 --> 00:04:48,209
organization.
177
00:04:48,209 --> 00:04:50,250
Nobody at your company opened a
box.
178
00:04:50,250 --> 00:04:52,009
Nobody touched the machine, and
179
00:04:52,009 --> 00:04:53,009
it already knows where it
180
00:04:53,009 --> 00:04:53,689
belongs.
181
00:04:53,689 --> 00:04:55,050
If the vendor doesn't do it, an
182
00:04:55,050 --> 00:04:56,569
admin can register devices by
183
00:04:56,569 --> 00:04:57,089
hand.
184
00:04:57,089 --> 00:04:59,209
That usually means collecting
the hardware hashes and
185
00:04:59,209 --> 00:05:01,879
uploading them in a file, which
is slower but works fine for a
186
00:05:01,879 --> 00:05:02,920
handful of machines.
187
00:05:02,920 --> 00:05:04,240
There's also a quiet side effect
188
00:05:04,240 --> 00:05:05,600
registering a device creates an
189
00:05:05,600 --> 00:05:06,600
object for it in your cloud
190
00:05:06,600 --> 00:05:07,319
directory.
191
00:05:07,319 --> 00:05:09,680
The device uses that object to
prove who it is before any
192
00:05:09,680 --> 00:05:10,879
person has signed in.
193
00:05:10,879 --> 00:05:13,600
That object is the reason a
brand new machine can show your
194
00:05:13,600 --> 00:05:15,959
company's name and logo on the
very first screen.
195
00:05:15,959 --> 00:05:18,680
Now the device is claimed and it
knows it belongs to you.
196
00:05:18,680 --> 00:05:19,879
Knowing who owns it isn't the
197
00:05:19,879 --> 00:05:20,839
same as knowing what it should
198
00:05:20,839 --> 00:05:21,920
become, though, and that's the
199
00:05:21,920 --> 00:05:23,480
job of the next piece the
200
00:05:23,480 --> 00:05:25,759
deployment profile, deployment
201
00:05:25,759 --> 00:05:27,040
profiles, the instructions the
202
00:05:27,040 --> 00:05:28,279
device follows.
203
00:05:28,279 --> 00:05:29,639
A registered device still needs
204
00:05:29,639 --> 00:05:30,800
instructions, and those
205
00:05:30,800 --> 00:05:31,920
instructions come from a
206
00:05:31,920 --> 00:05:33,120
deployment profile.
207
00:05:33,120 --> 00:05:35,560
Picture the profile as a short
list of decisions about the
208
00:05:35,560 --> 00:05:36,800
first run experience.
209
00:05:36,800 --> 00:05:38,839
It answers questions like
whether this device is meant for
210
00:05:38,839 --> 00:05:41,360
one person or for many, and
whether the sign in screen
211
00:05:41,360 --> 00:05:43,639
should carry the organization's
name and logo.
212
00:05:43,639 --> 00:05:46,480
It also decides whether the
setup skips certain screens that
213
00:05:46,480 --> 00:05:47,879
nobody ever needs to see.
214
00:05:47,879 --> 00:05:50,680
The profile gets assigned to the
device, and in most setups, that
215
00:05:50,680 --> 00:05:53,040
assignment happens automatically
through a device group.
216
00:05:53,040 --> 00:05:55,160
So nobody has to place each
machine by hand.
217
00:05:55,160 --> 00:05:56,319
When the device boots for the
218
00:05:56,319 --> 00:05:57,480
first time and connects to the
219
00:05:57,480 --> 00:05:58,759
network, it reaches out and
220
00:05:58,759 --> 00:06:00,199
pulls its profile down from the
221
00:06:00,199 --> 00:06:00,839
cloud.
222
00:06:00,839 --> 00:06:02,720
Then it follows that profile
step by step.
223
00:06:02,720 --> 00:06:03,839
A device that somehow ends up
224
00:06:03,839 --> 00:06:05,120
with no profile assigned doesn't
225
00:06:05,120 --> 00:06:05,720
simply break.
226
00:06:05,720 --> 00:06:08,240
It falls back to a default
profile, which matters the next
227
00:06:08,240 --> 00:06:10,560
time a machine behaves
differently from its neighbors.
228
00:06:10,560 --> 00:06:11,759
There's a second screen you
229
00:06:11,759 --> 00:06:13,079
should know about because it's
230
00:06:13,079 --> 00:06:14,259
the one people actually see
231
00:06:14,259 --> 00:06:15,079
during setup.
232
00:06:15,079 --> 00:06:17,480
It's called the enrollment
status page, which is really
233
00:06:17,480 --> 00:06:19,240
just a setup progress screen.
234
00:06:19,240 --> 00:06:20,439
While the device is applying
235
00:06:20,439 --> 00:06:22,040
settings and installing apps,
236
00:06:22,040 --> 00:06:23,519
this screen holds the user in
237
00:06:23,519 --> 00:06:24,899
place and shows how far along
238
00:06:24,899 --> 00:06:25,439
things are.
239
00:06:25,439 --> 00:06:26,759
Nobody lands on a half finished
240
00:06:26,759 --> 00:06:27,839
desktop and starts clicking
241
00:06:27,839 --> 00:06:28,879
around before the machine is
242
00:06:28,879 --> 00:06:29,600
ready.
243
00:06:29,600 --> 00:06:32,160
The profile is the recipe, and
the progress screen is the
244
00:06:32,160 --> 00:06:35,199
kitchen timer that stops you
from opening the oven too early.
245
00:06:35,199 --> 00:06:36,399
At this point, the device has an
246
00:06:36,399 --> 00:06:37,360
identity and a set of
247
00:06:37,360 --> 00:06:38,240
instructions.
248
00:06:38,240 --> 00:06:40,480
The last piece is the one
beginner's trip over.
249
00:06:40,480 --> 00:06:41,920
It involves two products with
250
00:06:41,920 --> 00:06:42,920
names that don't explain
251
00:06:42,920 --> 00:06:44,240
themselves, and those two
252
00:06:44,240 --> 00:06:45,839
products do two very different
253
00:06:45,839 --> 00:06:46,720
jobs.
254
00:06:46,720 --> 00:06:49,959
Joining the organization intra
join and Intune.
255
00:06:49,959 --> 00:06:53,160
The device needs two things from
your organization a place in the
256
00:06:53,160 --> 00:06:54,360
directory and a manager.
257
00:06:54,360 --> 00:06:55,959
The directory is Microsoft entry
258
00:06:55,959 --> 00:06:57,560
ID, which you can think of as
259
00:06:57,560 --> 00:06:59,040
the address book of every person
260
00:06:59,040 --> 00:07:00,394
and every device your company
261
00:07:00,394 --> 00:07:01,110
trusts.
262
00:07:01,110 --> 00:07:04,550
The manager is Microsoft Intune,
the tool it uses to look after
263
00:07:04,550 --> 00:07:06,069
devices after they're set up.
264
00:07:06,069 --> 00:07:07,589
Pushing settings, apps, and
265
00:07:07,589 --> 00:07:08,829
security rules to them over
266
00:07:08,829 --> 00:07:09,389
time.
267
00:07:09,389 --> 00:07:12,430
Joining the directory is called
an intra join, and it's simpler
268
00:07:12,430 --> 00:07:13,350
than it sounds.
269
00:07:13,350 --> 00:07:14,389
The device stops being a
270
00:07:14,389 --> 00:07:16,009
stranger and becomes a known,
271
00:07:16,009 --> 00:07:17,470
trusted member of that address
272
00:07:17,470 --> 00:07:17,709
book.
273
00:07:17,709 --> 00:07:20,269
The moment it joins that join
automatically triggers
274
00:07:20,269 --> 00:07:21,670
enrollment into Intune.
275
00:07:21,670 --> 00:07:22,870
That's the hand-off that gets
276
00:07:22,870 --> 00:07:24,069
the device, its apps, and its
277
00:07:24,069 --> 00:07:24,589
settings.
278
00:07:24,589 --> 00:07:27,149
And you don't have to flip a
second switch because the join
279
00:07:27,149 --> 00:07:28,310
itself is the trigger.
280
00:07:28,310 --> 00:07:30,550
This is the boundary that
confuses people the most.
281
00:07:30,550 --> 00:07:32,189
So it's worth saying plainly.
282
00:07:32,189 --> 00:07:34,910
Autopilot handles the first run
setup, and Intune handles
283
00:07:34,910 --> 00:07:37,509
everything that comes after the
two work together, but they
284
00:07:37,509 --> 00:07:38,709
aren't the same thing.
285
00:07:38,709 --> 00:07:41,829
Autopilot gets the device to the
starting line and Intune runs
286
00:07:41,829 --> 00:07:42,949
the race from there.
287
00:07:42,949 --> 00:07:45,069
One more join option might come
up in your reading, and it's
288
00:07:45,069 --> 00:07:46,709
called intra Hybrid Join.
289
00:07:46,709 --> 00:07:49,389
It keeps the connection to the
older on premises servers that
290
00:07:49,389 --> 00:07:50,870
some organizations still run.
291
00:07:50,870 --> 00:07:51,990
Not every company has moved
292
00:07:51,990 --> 00:07:53,149
fully to the cloud, and for
293
00:07:53,149 --> 00:07:54,430
some, this is the only path that
294
00:07:54,430 --> 00:07:54,990
fits.
295
00:07:54,990 --> 00:07:56,269
Microsoft's own guidance,
296
00:07:56,269 --> 00:07:58,110
though, is to set up new devices
297
00:07:58,110 --> 00:07:59,629
as cloud native with a plain
298
00:07:59,629 --> 00:08:00,980
intra join, since that gives the
299
00:08:00,980 --> 00:08:02,379
smoothest experience.
300
00:08:02,379 --> 00:08:03,819
Hybrid join stays mostly for the
301
00:08:03,819 --> 00:08:05,220
devices that already depend on
302
00:08:05,220 --> 00:08:05,620
it.
303
00:08:05,620 --> 00:08:08,019
That's the whole machine a
device gets claimed by its
304
00:08:08,019 --> 00:08:10,180
hardware hash, gets its
instructions from a profile,
305
00:08:10,180 --> 00:08:13,459
joins the directory, and hands
off to Intune for the long haul.
306
00:08:13,459 --> 00:08:15,019
The deployment modes just change
307
00:08:15,019 --> 00:08:16,420
who runs that same machine,
308
00:08:16,420 --> 00:08:17,740
depending on who happens to be
309
00:08:17,740 --> 00:08:18,259
standing there.
310
00:08:18,259 --> 00:08:19,899
When the box opens.
311
00:08:19,899 --> 00:08:21,500
The deployment modes explained
312
00:08:21,500 --> 00:08:22,779
simply, the modes aren't
313
00:08:22,779 --> 00:08:23,579
different products.
314
00:08:23,579 --> 00:08:24,579
There are different ways to run
315
00:08:24,579 --> 00:08:26,540
the same setup, and you pick one
316
00:08:26,540 --> 00:08:28,060
based on the situation in front
317
00:08:28,060 --> 00:08:28,420
of you.
318
00:08:28,420 --> 00:08:30,100
A few of them matter more than
the rest.
319
00:08:30,100 --> 00:08:31,699
User driven mode is the default.
320
00:08:31,699 --> 00:08:32,860
You probably picture.
321
00:08:32,860 --> 00:08:33,980
The device is meant for one
322
00:08:33,980 --> 00:08:35,740
person and that person runs the
323
00:08:35,740 --> 00:08:36,779
setup themselves.
324
00:08:36,779 --> 00:08:39,340
It's the right choice when a
laptop ships straight to an
325
00:08:39,340 --> 00:08:42,179
employee's home, and it even
works on virtual machines, the
326
00:08:42,179 --> 00:08:43,259
trade off is time.
327
00:08:43,259 --> 00:08:44,460
The user sits through both the
328
00:08:44,460 --> 00:08:45,860
device setup and their own
329
00:08:45,860 --> 00:08:47,460
account setup, and that can take
330
00:08:47,460 --> 00:08:48,059
a while.
331
00:08:48,059 --> 00:08:50,539
If you've ever waited on a new
work laptop while it churned
332
00:08:50,539 --> 00:08:53,379
through setup screens, you were
watching this mode do its job.
333
00:08:53,379 --> 00:08:54,679
Pre-provisioned mode splits the
334
00:08:54,679 --> 00:08:55,779
work, and it used to be called
335
00:08:55,779 --> 00:08:56,940
White glove.
336
00:08:56,940 --> 00:09:00,139
A technician or the vendor runs
the slow first half of the setup
337
00:09:00,139 --> 00:09:02,340
and then seals the device back
up and ships it.
338
00:09:02,340 --> 00:09:03,899
When the user finally opens it,
339
00:09:03,899 --> 00:09:05,580
they only finish a short flow,
340
00:09:05,580 --> 00:09:06,960
so their setup time drops to
341
00:09:06,960 --> 00:09:07,500
minutes.
342
00:09:07,500 --> 00:09:10,100
The catch is that it needs a
security chip called a TPM short
343
00:09:10,100 --> 00:09:11,779
for Trusted Platform module.
344
00:09:11,779 --> 00:09:14,659
That's a small chip inside the
device that can prove the
345
00:09:14,659 --> 00:09:15,700
machine is genuine.
346
00:09:15,700 --> 00:09:17,139
That means physical devices only
347
00:09:17,139 --> 00:09:18,100
with no virtual machines
348
00:09:18,100 --> 00:09:18,899
allowed.
349
00:09:18,899 --> 00:09:20,259
Self-deploying mode takes the
350
00:09:20,259 --> 00:09:21,259
user out of the picture
351
00:09:21,259 --> 00:09:21,899
entirely.
352
00:09:21,899 --> 00:09:24,899
The device sets itself up with
little to no interaction, which
353
00:09:24,899 --> 00:09:28,220
makes it perfect for a kiosk, a
digital signage screen, or a
354
00:09:28,220 --> 00:09:30,620
shared device that a lot of
people will use.
355
00:09:30,620 --> 00:09:32,059
It also needs that TPM chip.
356
00:09:32,059 --> 00:09:33,820
So again, no virtual machines.
357
00:09:33,820 --> 00:09:35,379
And because no user is involved,
358
00:09:35,379 --> 00:09:36,940
you can't assign the device to a
359
00:09:36,940 --> 00:09:38,059
specific person.
360
00:09:38,059 --> 00:09:40,779
Two more names are worth knowing
so they don't confuse you later.
361
00:09:40,779 --> 00:09:43,700
Autopilot for existing devices
isn't really a mode of its own.
362
00:09:43,700 --> 00:09:44,899
It's a way to put a fresh copy
363
00:09:44,899 --> 00:09:46,100
of windows onto a machine that
364
00:09:46,100 --> 00:09:47,340
needs one, then hand that
365
00:09:47,340 --> 00:09:48,220
machine off to a normal
366
00:09:48,220 --> 00:09:49,379
autopilot run.
367
00:09:49,379 --> 00:09:50,740
It leans on Microsoft's older
368
00:09:50,740 --> 00:09:52,059
device management tool to do the
369
00:09:52,059 --> 00:09:53,220
heavy lifting.
370
00:09:53,220 --> 00:09:54,860
Autopilot reset is the reset
371
00:09:54,860 --> 00:09:56,259
button, which takes a device
372
00:09:56,259 --> 00:09:57,779
that's already registered and
373
00:09:57,779 --> 00:09:58,940
sends it back to a business
374
00:09:58,940 --> 00:09:59,779
ready state.
375
00:09:59,779 --> 00:10:03,210
Handy when a laptop changes
hands or needs a clean start.
376
00:10:03,210 --> 00:10:04,490
One practical detail about
377
00:10:04,490 --> 00:10:05,830
Pre-provisioning catches people
378
00:10:05,830 --> 00:10:06,610
off guard.
379
00:10:06,610 --> 00:10:08,389
Microsoft recommends waiting at
380
00:10:08,389 --> 00:10:09,610
least ninety minutes between the
381
00:10:09,610 --> 00:10:10,929
technician's half of the setup
382
00:10:10,929 --> 00:10:12,129
and the user's half, so the
383
00:10:12,129 --> 00:10:13,330
security tokens have time to
384
00:10:13,330 --> 00:10:14,169
refresh.
385
00:10:14,169 --> 00:10:15,169
The users half should also
386
00:10:15,169 --> 00:10:16,409
finish within six months of the
387
00:10:16,409 --> 00:10:17,450
technician's work.
388
00:10:17,450 --> 00:10:18,570
Missed that second window and
389
00:10:18,570 --> 00:10:19,809
the certificates can expire,
390
00:10:19,809 --> 00:10:21,049
which shows up later as setup
391
00:10:21,049 --> 00:10:21,690
errors.
392
00:10:21,690 --> 00:10:23,289
Speaking of how autopilot looks
393
00:10:23,289 --> 00:10:24,929
today, there's a newer, simpler
394
00:10:24,929 --> 00:10:26,389
flavor that Microsoft now points
395
00:10:26,389 --> 00:10:27,970
people toward, and it changes a
396
00:10:27,970 --> 00:10:28,970
few of the rules we just
397
00:10:28,970 --> 00:10:29,809
covered.
398
00:10:29,809 --> 00:10:31,490
The newer, simpler flavor
399
00:10:31,490 --> 00:10:32,850
autopilot today comes in two
400
00:10:32,850 --> 00:10:33,409
flavors.
401
00:10:33,409 --> 00:10:36,169
The one we've been describing is
the classic version, and there's
402
00:10:36,169 --> 00:10:39,049
a newer one called Windows
Autopilot Device Preparation.
403
00:10:39,049 --> 00:10:41,450
The idea behind the newer one is
to keep the good parts and
404
00:10:41,450 --> 00:10:42,730
remove the fiddly parts.
405
00:10:42,730 --> 00:10:45,289
The biggest change is that it
doesn't ask you to pre-stage
406
00:10:45,289 --> 00:10:46,129
devices at all.
407
00:10:46,129 --> 00:10:48,730
Instead of registering every
machine ahead of time, the
408
00:10:48,730 --> 00:10:51,690
device gets grouped the moment
it enrolls and configured right
409
00:10:51,690 --> 00:10:55,090
then, which cuts out an entire
preparation step that used to
410
00:10:55,090 --> 00:10:55,889
trip people up.
411
00:10:55,889 --> 00:10:58,009
There's no hardware hash to
chase down first.
412
00:10:58,009 --> 00:10:59,850
What you give up is some
flexibility.
413
00:10:59,850 --> 00:11:02,559
Device preparation supports a
plain Android join only, so no
414
00:11:02,559 --> 00:11:04,879
hybrid join, and it runs on
windows eleven only.
415
00:11:04,879 --> 00:11:07,399
It can deliver fewer apps and
scripts during setup than the
416
00:11:07,399 --> 00:11:09,799
classic version, and it doesn't
offer Pre-provisioning or
417
00:11:09,799 --> 00:11:10,960
Self-deploying at all.
418
00:11:10,960 --> 00:11:12,960
What you gain is simplicity and
speed.
419
00:11:12,960 --> 00:11:14,240
There's one policy to configure
420
00:11:14,240 --> 00:11:15,840
instead of several moving parts,
421
00:11:15,840 --> 00:11:17,159
and the setup experience is more
422
00:11:17,159 --> 00:11:17,919
consistent.
423
00:11:17,919 --> 00:11:19,299
The reporting is also close to
424
00:11:19,299 --> 00:11:20,639
real time, so when something
425
00:11:20,639 --> 00:11:21,679
goes wrong, you can see where
426
00:11:21,679 --> 00:11:22,440
it's stuck.
427
00:11:22,440 --> 00:11:25,200
For a beginner, the honest
summary is this classic
428
00:11:25,200 --> 00:11:28,320
autopilot gives you more options
and more control, while device
429
00:11:28,320 --> 00:11:31,440
preparation gives you fewer
knobs, a faster setup, and a
430
00:11:31,440 --> 00:11:33,080
clearer view of what happened.
431
00:11:33,080 --> 00:11:36,159
Both are autopilot, and plenty
of organizations run them side
432
00:11:36,159 --> 00:11:39,519
by side before you assume it
always works, though, it helps
433
00:11:39,519 --> 00:11:43,440
to know where it can trip you
up, where it can trip you up.
434
00:11:43,440 --> 00:11:45,320
Autopilot still needs the
internet during setup.
435
00:11:45,320 --> 00:11:47,759
That sounds obvious, but it
means a device that can't reach
436
00:11:47,759 --> 00:11:50,360
the network, can't finish a
brand new laptop.
437
00:11:50,360 --> 00:11:51,500
Sitting in a warehouse with no
438
00:11:51,500 --> 00:11:53,340
Wi-Fi stays stuck until it gets
439
00:11:53,340 --> 00:11:54,120
a connection.
440
00:11:54,120 --> 00:11:56,679
During setup, the device is
talking to Microsoft's cloud
441
00:11:56,679 --> 00:11:59,360
services the whole time, which
is why a solid network
442
00:11:59,360 --> 00:12:01,029
connection isn't optional.
443
00:12:01,029 --> 00:12:02,350
The TPM requirement narrows
444
00:12:02,350 --> 00:12:03,389
things down more than people
445
00:12:03,389 --> 00:12:03,950
expect.
446
00:12:03,950 --> 00:12:06,029
Pre-provisioning and
Self-deploying both need that
447
00:12:06,029 --> 00:12:08,830
security chip, so virtual
machines won't work for either
448
00:12:08,830 --> 00:12:12,029
one, even when the virtual
machine has a virtual TPM.
449
00:12:12,029 --> 00:12:13,470
If your team does a lot of its
450
00:12:13,470 --> 00:12:14,870
testing in virtual machines,
451
00:12:14,870 --> 00:12:16,350
that's a real limitation to plan
452
00:12:16,350 --> 00:12:16,789
around.
453
00:12:16,789 --> 00:12:19,789
Hybrid join adds its own wrinkle
if a device needs to join both
454
00:12:19,789 --> 00:12:22,629
the cloud and an older on
premises domain, it also needs a
455
00:12:22,629 --> 00:12:24,710
connection to a domain
controller during setup.
456
00:12:24,710 --> 00:12:25,870
For a fully remote employee,
457
00:12:25,870 --> 00:12:27,309
that's often a deal breaker, and
458
00:12:27,309 --> 00:12:28,610
it's one more reason Microsoft
459
00:12:28,610 --> 00:12:30,110
nudges new devices toward a
460
00:12:30,110 --> 00:12:30,350
plane.
461
00:12:30,350 --> 00:12:31,830
Cloud join licensing is real,
462
00:12:31,830 --> 00:12:32,950
and it's the part beginners
463
00:12:32,950 --> 00:12:33,590
skip.
464
00:12:33,590 --> 00:12:36,389
Autopilot rides on the directory
and device management features
465
00:12:36,389 --> 00:12:38,470
that come with subscriptions
like Microsoft three hundred
466
00:12:38,470 --> 00:12:41,750
sixty five Business Premium, or
the E3 and E5 plans.
467
00:12:41,750 --> 00:12:44,549
Those licenses have to be
assigned to actual people before
468
00:12:44,549 --> 00:12:45,990
their devices can enroll.
469
00:12:45,990 --> 00:12:48,590
A license sitting unused in a
spreadsheet does nothing for the
470
00:12:48,590 --> 00:12:49,830
laptop on the desk.
471
00:12:49,830 --> 00:12:51,470
There's a registration gotcha
too.
472
00:12:51,470 --> 00:12:53,830
If someone deletes the devices
object in the directory,
473
00:12:53,830 --> 00:12:54,990
enrollment can fail.
474
00:12:54,990 --> 00:12:56,309
On top of that, a device that
475
00:12:56,309 --> 00:12:57,669
went through Pre-provisioning
476
00:12:57,669 --> 00:12:59,149
can't simply re-enroll itself
477
00:12:59,149 --> 00:13:00,850
after the first deployment to
478
00:13:00,850 --> 00:13:02,169
run it again, an admin has to
479
00:13:02,169 --> 00:13:03,350
delete the device record and
480
00:13:03,350 --> 00:13:04,110
start over.
481
00:13:04,110 --> 00:13:05,590
None of this is a deal breaker.
482
00:13:05,590 --> 00:13:08,190
It's just the difference between
a setup that just works and a
483
00:13:08,190 --> 00:13:10,870
laptop sitting on a progress
screen at nine in the morning.
484
00:13:10,870 --> 00:13:12,789
Knowing the limits is what
separates someone who
485
00:13:12,789 --> 00:13:15,909
understands autopilot from
someone who has only memorized
486
00:13:15,909 --> 00:13:17,750
the marketing recap.
487
00:13:17,750 --> 00:13:19,149
And one question for you.
488
00:13:19,149 --> 00:13:20,470
So let's pull it together.
489
00:13:20,470 --> 00:13:23,909
Windows autopilot is cloud based
setup for new windows devices.
490
00:13:23,909 --> 00:13:26,490
A device gets claimed by its
hardware hash, told what to
491
00:13:26,490 --> 00:13:29,789
become by a deployment profile,
given an identity by entry ID,
492
00:13:29,789 --> 00:13:31,909
and managed afterward by Intune.
493
00:13:31,909 --> 00:13:33,269
The modes just change who does
494
00:13:33,269 --> 00:13:35,070
the setup, and the newer device
495
00:13:35,070 --> 00:13:36,470
preparation flavor trades some
496
00:13:36,470 --> 00:13:37,669
flexibility for speed and
497
00:13:37,669 --> 00:13:38,509
simplicity.
498
00:13:38,509 --> 00:13:39,789
The one idea underneath all of
499
00:13:39,789 --> 00:13:41,470
it is this the laptop belongs to
500
00:13:41,470 --> 00:13:42,669
your organization before anyone
501
00:13:42,669 --> 00:13:43,950
opens the box, and that's the
502
00:13:43,950 --> 00:13:45,190
whole reason it can set itself
503
00:13:45,190 --> 00:13:45,669
up.
504
00:13:45,669 --> 00:13:47,110
So here's a question worth
sitting with.
505
00:13:47,110 --> 00:13:49,470
If a device can be trusted and
ready from the moment it's
506
00:13:49,470 --> 00:13:52,309
built, what does that change
about how your team thinks about
507
00:13:52,309 --> 00:13:53,950
bringing a new person on board?
508
00:13:53,950 --> 00:13:56,429
If this made autopilot feel a
little less mysterious,
509
00:13:56,429 --> 00:13:59,990
subscribe to M365 FM to master
the tools and the mindset
510
00:13:59,990 --> 00:14:01,470
shaping the future of work.
