User-driven Microsoft Entra hybrid join: Create and assign user-driven Microsoft Entra hybrid join Autopilot profile

• Applies to:

  ✅ Windows 11, ✅ Windows 10

Autopilot user-driven Microsoft Entra hybrid join steps:

• Step 1: Set up Windows automatic Intune enrollment
• Step 2: Install the Intune Connector
• Step 3: Increase the computer account limit in the Organizational Unit (OU)
• Step 4: Register devices as Autopilot devices
• Step 5: Create a device group
• Step 6: Configure and assign Autopilot Enrollment Status Page (ESP)

• Step 7: Create and assign Microsoft Entra hybrid join Autopilot profile

• Step 8: Configure and assign domain join profile
• Step 9: Assign Autopilot device to a user (optional)
• Step 10: Deploy the device

For an overview of the Windows Autopilot user-driven Microsoft Entra hybrid join workflow, see Windows Autopilot user-driven Microsoft Entra hybrid join overview

Create and assign user-driven Microsoft Entra hybrid join Autopilot profile

The Autopilot profile specifies how the device is configured during Windows Setup and what is shown during the out of box experience (OOBE).

When an admin creates an Autopilot profile for the user-driven scenario, devices with this Autopilot profile are associated with the user enrolling the device. User credentials are required to enroll the device.

The difference between a Microsoft Entra join and a Microsoft Entra hybrid join is that the Microsoft Entra hybrid join scenario joins both an on-premises domain and Microsoft Entra ID during Autopilot. The user-driven Microsoft Entra join scenario only joins Microsoft Entra ID during Autopilot.

Tip

For Configuration Manager admins, the Autopilot profile is similar to some of the configuration that takes place during a task sequence via an unattend.xml file. The unattend.xml file is configured during the Apply Windows Settings and Apply Network Settings steps. Note however that Autopilot doesn't use unattend.xml files.

To create a user-driven Microsoft Entra hybrid join Autopilot profile, follow these steps:

1. Sign in to the Microsoft Intune admin center.

2. In the Home screen, select Devices in the left hand pane.

3. In the Devices | Overview screen, under By platform, select Windows.

4. In the Windows | Windows devices screen, select Windows enrollment.

5. Under Windows Autopilot Deployment Program, select Deployment Profiles.

6. In the Windows Autopilot deployment profiles screen, select Create Profile > Windows PC.

7. The Create profile screen opens. In the Basics page:

   1. Next to Name, enter a name for the Autopilot profile.

   2. Next to Description, enter a description.

   3. Select Next.

      Note

      Set the option Convert all targeted devices to Autopilot to Yes. While this tutorial concentrates on new devices where the device is manually imported as an Autopilot device using the hardware hash, this option can be helpful when assigning Autopilot profiles to device groups that contain existing devices. For example, this option is helpful when using the Windows Autopilot for existing devices scenario where existing devices may need to be registered as an Autopilot device after the Autopilot deployment has completed. For more information, see Register device for Windows Autopilot.

8. In the Out-of-box experience (OOBE) page:

   • For Deployment mode, select User-driven.

   • For Join to Microsoft Entra ID as, select Microsoft Entra hybrid joined. After this option is selected, several the options underneath this option will change.

   • For Skip AD connectivity check, select No. This section of the tutorial assumes that the device undergoing Autopilot is an on-premises internal client and that has direct connectivity to the on-premises domain and domain controllers. For off-premise/Internet scenarios where VPN connectivity is required, see Off-premises/Internet scenarios and VPN connectivity.

   • For Microsoft Software License Terms, select Hide to skip the EULA page.

   • For Privacy settings, select Hide to skip the privacy settings.

   • For Hide change account options, select Hide.

   • For User account type, select the desired account type for the user (Administrator or Standard user). If Administrator is chosen, the user is added to the local Admin group.

   • For Allow pre-provisioned deployment, select No.

     Note

     For the Windows Autopilot for pre-provisioned deployment Microsoft Entra hybrid join scenario, see Step by step tutorial for Windows Autopilot for pre-provisioned deployment Microsoft Entra hybrid join in Intune

   • For Language (Region), select Operating system default to use the default language for the operating system being configured. If another language is desired, select the desired language from the drop-down list.

   • For Automatically configure keyboard, select Yes to skip the keyboard selection page.

   • The Apply device name template is greyed out for Microsoft Entra hybrid join scenarios. Although not as robust, device names can be specified during the Configure and assign domain join profile step.

   Note

   The above settings have been selected to minimize needed user interaction during device setup. However, some of the settings that are hidden can instead be shown as desired. For example, some regions may require that Privacy settings always be shown.

   Note

   If the language/region and keyboard screens are set to hidden, they may still be displayed if there's no network connectivity at the start of the Autopilot deployment. These screens are displayed because there's no network connectivity at the start of the deployment to download the Autopilot profile where the settings to hide these screens are specified. Once network connectivity is established, the Autopilot profile is downloaded and any additional screen settings should work as expected.

9. Once the options in the Out-of-box experience (OOBE) page are configured as desired, select Next.

10. In the Assignments page:

    1. Under Included groups, choose Add groups.

    Note

    Make sure to add the correct device groups under Included groups and not under Excluded groups. Accidentally adding the desired device groups under Excluded groups prevents devices in those device groups from receiving the Autopilot profile.

    1. In the Select groups to include window that opens, select the groups that the Autopilot profile should be assigned to. This device group(s) is normally the device group(s) created in the previous Create device group step. Once done, select Select.

    2. Under Included groups > Groups, ensure the correct group(s) are selected, and then select Next.

11. In the Review + Create page, review and verify that all of the settings are set as desired, and then choose Create to create the Autopilot profile.

Verify device has an Autopilot profile assigned to it

Before deploying a device, ensure that an Autopilot profile is assigned to a device group that the device is a member of. Autopilot profile assignment to a device can take some time after the Autopilot profile is assigned to the device group or after the device is added to the device group. To verify that the profile is assigned to a device, follow these steps:

1. Sign in to the Microsoft Intune admin center.

2. In the Home screen, select Devices in the left pane.

3. In the Devices | Overview screen, under By platform, select Windows.

4. In the Windows | Windows devices screen, select Windows enrollment.

5. Under Windows Autopilot Deployment Program, select Devices.

6. In the Windows Autopilot devices screen that opens:

   1. Find the desired device that Autopilot deployment profile assignment status needs to be checked.

   2. Once the device is located, its current status is listed under the Profile status column. The status has one of the following values:

      • Not assigned: An Autopilot deployment profile isn't assigned to the device.

      • Assigning: An Autopilot deployment profile is being assigned to the device.

      • Assigned: An Autopilot deployment profile is assigned to the device.

      • Fix pending: When a hardware change occurs on a device, this status displays while Intune tries to register the new hardware. When the link for the Fix pending status is selected, the following message appears:

        We've detected a hardware change on this device. We're trying to automatically register the new hardware. You don't need to do anything now; the status will be updated at the next check in with the result.

        If Intune is able to successfully register the new hardware, Intune updates the profile status when the device next checks into Intune. For more information on the Fix pending status, see the following articles:

        • Autopilot profile not applied after reimaging to an older OS version.
        • Return of key functionality for Windows Autopilot sign-in and deployment experience.
        • Windows Autopilot motherboard replacement scenario guidance

      • Attention required: If Intune is unable to register the new hardware after a hardware change occurs on a device, the device can't receive the Autopilot profile until the device is reset and the device re-registers. For more information on this status and how to deregister/re-register a device, see the following articles:

        • Autopilot profile not applied after reimaging to an older OS version.
        • Return of key functionality for Windows Autopilot sign-in and deployment experience.
        • Windows Autopilot motherboard replacement scenario guidance
        • Deregister a device

      Before starting the Autopilot deployment process on a device, make sure that in the Windows Autopilot devices page:

      • The device's Profile status status is Assigned.
      • In the properties of the device, Date assigned has a value.
      • In the properties of the device, Assigned profile displays the expected Autopilot profile.

Note

Intune periodically checks for new devices in the assigned device groups, and then begins the process of assigning profiles to those devices. Due to several different factors involved in the process of Autopilot profile assignment, an estimated time for the assignment can vary from scenario to scenario. These factors can include Microsoft Entra groups, membership rules, hash of a device, Intune and Autopilot service, and internet connection. The assignment time varies depending on all the factors and variables involved in a specific scenario.

Off-premises/Internet scenarios and VPN connectivity

Windows Autopilot user-driven Microsoft Entra hybrid join supports off-premises/Internet scenarios where direct connectivity to Active directory and domain controllers isn't available. However, an off-premises/Internet scenario doesn't eliminate the need for connectivity to Active Directory and a domain controller during the domain join. In an off-premises/Internet scenario, connectivity to Active Directory and a domain controller can be established via a VPN connection during the Autopilot process.

For off-premises/Internet scenarios requiring VPN connectivity, the only change in the Autopilot profile would be in the setting Skip AD connectivity check. In the Create and assign user-driven Microsoft Entra hybrid join Autopilot profile section, the Skip AD connectivity check setting should be set to Yes instead of to No. Setting this option to Yes prevents the deployment from failing since there's no direct connectivity to Active Directory and domain controllers until the VPN connection is established.

In addition to changing the Skip AD connectivity check setting to Yes in the Autopilot profile, VPN support also relies on the following prerequisites:

• The VPN solution can be deployed and installed with Intune.
• The VPN solution needs to support one of the following options:
  • Lets the user manually establish a VPN connection from the Windows sign-in screen.
  • Automatically establishes a VPN connection as needed.

The VPN solution would need to be installed and configured via Intune during the Autopilot process. Configuration would need to include deploying any required device certificates if needed by the VPN solution. Once the VPN solution is installed and configured on the device, the VPN connection can be established, either automatically or manually by the user, at which point the domain join can occur. For more information and support on VPN solutions during Autopilot, consult the respective VPN vendor.

Note

Some VPN configurations aren't supported because the connection isn't initiated until the user signs into Windows. Unsupported VPN configurations include:

• VPN solutions that use user certificates
• Non-Microsoft UWP VPN plug-ins from the Windows Store

Next step: Configure and assign domain join profile

Step 8: Configure and assign domain join profile

More information

For more information on configuring Autopilot profiles, see the following article(s):

• Configure Autopilot profiles

• User-driven mode for Microsoft Entra hybrid join with VPN support
• BYO VPNs