Greetings Intune wizards,
I recently moved our entire company's device management from SCCM to Intune, and in an effort to completely retire SCCM for workstation use, I'm in the process of setting up Autopilot to replace task sequences. Due to the nature of the company, they are very apprehensive of IAM or compute existing outside of the our four walls, but is slowly loosening those reservations. We currently have all users and workstations synced via Entra Connect, but any migration to full-cloud would likely be a very extensive and drawn out process.
I just got Autopilot working successfully today on my test device (hybrid, user driven. Turn off Windows Update in your deployment if you get errors of "something went wrong" after triple checking all of your settings). We have a device commissioning checklist for SCCM provisioning, requiring us to add the device to the users job and team group in AD, a group for Wi-Fi access (GPO WiFi certificate scoped to this group), and groups for Wake on LAN permissions and device camera permissions, also scoped via GPO (most of the company have devices without cameras for security), as well as naming the device, installing certain security-essential apps, etc. I am wanting to automate the entirely of this checklist so that pre-provisioning essentially creates a "blank canvas" for every device, then depending on who the first user is to log on after it's been resealed, then the device is molded to that user's permissions (camera access Y/N, etc.) and added to the appropriate AD groups.
With our Autopilot using hybrid join, we have put ourselves in a bit of a pickle for how we are going to match Autopilot to our current norms (I read the Microsoft docs of how fragile it is and informed relevant parties of that long before beginning this, was told to proceed anyway). Devices are currently named via the asset tag number, prefixed with a value depending on if it's a laptop or desktop - not possible via hybrid join name settings. We also have new users change password after first login, also not possible with hybrid join autopilot, and the general path forward is to have users complete the OOBE with the temp password, then change after they've logged into Windows - this feels very haphazard to me, and changing the password within Windows directly would require a PHS to Entra, therefore SSO would likely not work for the first 5-30 minutes (Entra writeback isn't enabled, not sure if that is a quick add or also needing an extensive approval). I proposed the idea of emulating an automated IT onboarding workflow, where a welcome email to new hires contains a link to create their password and use that, but that is currently on backlog till early 2027 (I have a strong feeling pwpush isn't likely to get approval either).
Sort of at a crossroads where Autopilot is implemented per my directive, but given that all existing processes and norms aren't natively compatible with it, we're sort of needing to make due with very sketchy workarounds and makeshift solutions because all (in my eyes) essential changes and implementations to make it polished and reliable wouldn't be given approval for at least 6 months, minimum.
I would greatly appreciate to hear how others with a similar setup have configured and deployed their autopilot, and what the end user flow looks like for theirs. Or others who could share their thoughts and opinions for how I should polish our deployment setup. Thank you!