+- Sick Gaming (https://www.sickgaming.net)
+-- Forum: Computers (https://www.sickgaming.net/forum-86.html)
+--- Forum: Windows (https://www.sickgaming.net/forum-89.html)
+--- Thread: Microsoft - How AutoPilot helps schools manage shared devices (/thread-89163.html)
Microsoft - How AutoPilot helps schools manage shared devices - xSicKxBot - 03-09-2019
How AutoPilot helps schools manage shared devices
<div style="margin: 5px 5% 10px 5%;"><img src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices.png" width="596" height="524" title="" alt="" /></div><div><iframe class='youtube-player' type='text/html' width='500' height='281' src='https://www.youtube.com/embed/JrEU84KK2lQ?version=3&rel=1&fs=1&autohide=2&showsearch=0&showinfo=1&iv_load_policy=1&wmode=transparent' allowfullscreen='true' style='border:0;'></iframe>
<p>In my job I chat a lot with both school leaders and IT admins about how they can simplify the management of their devices, making it faster and easier for their end users (usually students, teachers and admin staff) to get started and complete the work they need to do on a device.</p>
<p>Unlike many corporate environments, schools have a very high number of “shared devices” in operation, where students of different year levels require access on the same device and, in some scenarios, even teachers need to log into the same device and access different apps and security settings. In the next two blog posts I’m going to go a bit deeper into how schools can approach this challenge with modern deployment practices, leveraging cloud identity in AzureAD, easier enrollment of devices using Microsoft Autopilot and finally a couple of tweaks for a faster user sign-in experience using Microsoft Intune as the Mobile Device Management (MDM) tool.</p>
<h2>Overview:</h2>
<p>As this blog post will be a little longer (and more technical) I’m going to give you a break down of what is to come so you can skip to the important sections relevant to you:</p>
<ul>
<li>Part One:
<ul>
<li>Identity – why use a cloud identity?</li>
<li>Why use AutoPilot?</li>
<li>Configuring Autopilot</li>
<li>Enrolling your device</li>
</ul>
</li>
<li>Part Two:
<ul>
<li>Intune vs Intune for Education</li>
<li>What are CSP?</li>
<li>Building a custom CSP Policy</li>
<li>Using LOB App Deployment in Intune</li>
</ul>
</li>
</ul>
<p>Now it’s worth stating at this stage that I am not an IT administrator by profession. Whilst I’m probably more technical than many, I’ve got the following working through a combination of relying on the detailed guides in the<span> </span><a target="_blank" href="https://docs.microsoft.com/" rel="noopener noreferrer">Microsoft Docs</a> and awesome technical colleagues who have shared some of their expertise with me. Additionally, like you, I read a bunch of blogs to see how people have done this in the past. This blog is a small contribution to the community who like to learn from other’s experiences. If you’re reading this and are more technical than me and see some improvements or corrections in what I’ve done – I’d love to hear from you in the comments section below.</p>
<p>With that said, let’s get started!</p>
<h2>Identity – why use a cloud identity?</h2>
<p>It’s amazing how many conversations I’ve been having around cloud identities recently as school leaders are starting to understand they need to be able to simplify user access to key resources via Single Sign On (SSO), and open up both cloud/internet solutions as well as traditional on-premise hosted solutions. There are plenty of confusing diagrams out there trying to explain what this is about – the following is the simplest I could find:</p>
<p><img class="lazyload alignnone size-full wp-image-5432" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices.png" alt="AzureAD.png" width="595" height="524"></p>
<p><img class="alignnone size-full wp-image-5432" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices.png" alt="AzureAD.png" width="595" height="524"></p>
<p>Essentially, the above is showing two scenarios:</p>
<ol>
<li>The user may sign into an “on-premise” identity platform (on the left), in this case Active Directory (still incredibly common in schools) which, through the use of a tool called<span> </span><a target="_blank" href="https://docs.microsoft.com/en-us/azure/active-directory/hybrid/whatis-hybrid-identity" rel="noopener noreferrer">AzureAD Connect</a><span> </span>can automatically sign into a cloud identity as well, in this case Azure Active Directory (AzureAD or even AAD).</li>
<li>Alternatively, the user may sign directly into a cloud service (on the right) using their AzureAD credentials. In fact, if their device is managed by the school, it may even be joined to AzureAD only.</li>
</ol>
<p>Why does this matter? As an example, I was talking with a school recently where teachers were required to use up to four different usernames/passwords to access their key platforms such as signing into a computer, accessing their email, accessing their Student Management System (SMS) and accessing their cloud collaboration suite (Office365 in this case). Simplifying this through a single cloud identity saves time and frustration for everyone! It also improves security as people are more likely to choose a secure password if they only have one to remember.</p>
<p>Additionally, schools are increasingly wanting to sign into third party cloud apps with the same credentials –<span> </span><a target="_blank" href="https://samuelmcneill.com/2018/04/24/cloud-mobile-device-management-delivers-for-schools-partners/" rel="noopener noreferrer">this blog post I wrote shows a school accessing eight different solutions with just their AzureAD identity.</a></p>
<blockquote>
<p>The key point is: identity matters. If your school does not have a cloud identity of some sort, you’re going to be inherently limited in what you can do.</p>
</blockquote>
<p>As the focus of this blog is primarily around AutoPilot, I’m not going to go deep into Identity – some useful background reading I would share is earlier blog posts I’ve written around:</p>
<p>For the purposes of this blog, if you’re wanting to use AutoPilot then your Office365 Tenant must have either the AzureAD P1 or P2 plans –<span> </span><a target="_blank" href="https://docs.microsoft.com/en-us/azure/active-directory/fundamentals/active-directory-whatis" rel="noopener noreferrer">see the differences here.</a> With many schools opting for the M365 A3 Suite, this includes AzureAD P1:</p>
<blockquote>
<p><strong>Azure Active Directory Premium P1.</strong> In addition to the Free and Basic features, P1 also lets your hybrid users access both on-premises and cloud resources. It also supports advanced administration, such as dynamic groups, self-service group management, Microsoft Identity Manager (an on-premises identity and access management suite) and cloud write-back capabilities, which allow self-service password reset for your on-premises users.</p>
</blockquote>
<p>To proceed with AutoPilot you need your users in AzureAD (and licensed with P1 or P2) so if you’ve not got that far, best to stop and sort before continuing on (if you want help with this, check out<span> </span><a target="_blank" href="https://sds.microsoft.com/" rel="noopener noreferrer">School Data Sync</a><span> </span>which can automatically add users from your Student Information System).</p>
<h2>Why use AutoPilot?</h2>
<p>It’s always a good question to ask, and before answering if you’re brand new to AutoPilot then it’s worth watching<span> </span><a target="_blank" href="https://www.youtube.com/watch?v=JrEU84KK2lQ" rel="noopener noreferrer">the video</a><span> </span>at the top of this blog post and then getting into<span> </span><a target="_blank" href="https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/windows-autopilot" rel="noopener noreferrer">the official AutoPilot Documentation here</a>. If you’re coming from an Apple device management world and are familiar with the Device Enrollment Program (DEP) then the concepts of AutoPilot will be very familiar for you.</p>
<p><img class="lazyload alignnone size-full wp-image-5434" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices-1.png" alt="AutoPilot" width="595" height="510"></p>
<p><img class="alignnone size-full wp-image-5434" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices-1.png" alt="AutoPilot" width="595" height="510"></p>
<blockquote>
<p class>Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, re-purpose and recover devices.<br />This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that’s easy and simple.</p>
<p>Windows Autopilot is designed to simplify all parts of the life cycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users.</p>
</blockquote>
<p>Back to the why use it…..</p>
<ul>
<li>Devices become enrolled / locked to your organisation. If a user (authorised or not) resets the Win10 OS back to factory settings, as soon as it connects to the internet again it will register back to your organisation, making it largely useless to anyone if it was stolen.</li>
<li>Speeds up and simplifies the Win10 setup process – you can optionally skip quite a few of the steps you normally need to undertake in Win10 e.g. requiring the user to agree to the EULA, choosing their privacy settings, configure whether the user will be an Administrator or a Standard user, and depending on deployment mode, can even skip keyboard preferences.</li>
<li>Devices can be assigned to specific users, meaning when they turn it on for the first time, connect to the internet they’re greeted by name as part of their organisation.</li>
<li>AutoPilot Reset allows an IT Admin to remotely reset the device, returning it to the original state, <em>but</em><span> </span>keeping it joined to AzureAD and enrolled into Intune for management – think of this like a “spring clean” at the beginning of the school year or new Term.</li>
</ul>
<p>In short, AutoPilot is designed to make your life easier!</p>
<h2>Configuring Autopilot</h2>
<p>For my demo and testing, I’m using an Acer B117 laptop, something that is available in the<span> </span><a href="https://www.microsoft.com/en-nz/education/buy-license/right-device/default.aspx">NZ Education Right Device Campaign</a>, a low cost, low spec Win10 device with 4GB RAM and options around 64/128GB SSD storage. One of the beauties of AutoPilot is that supported OEM devices can send the unique Hardware Identifier (HWID) to the purchasing organisation / school in advance of receiving the devices, allowing for the configuration of the entire environment in advance of even receiving the hardware.</p>
<p>An obvious upside for this would be the ability to ‘drop ship’ devices to remote employees directly from purchase, without the need for IT Admins to even site the device.</p>
<p>In my case, I needed to manually extract the HWID from the Acer laptop, which can easily be accomplished with some basic PowerShell (run as local Administrator):</p>
<blockquote>
<p>md c:HWID Set-Location</p>
<p>c:HWID Set-ExecutionPolicy Unrestricted</p>
<p>Install-Script -Name Get-WindowsAutoPilotInfo</p>
<p>Get-WindowsAutoPilotInfo.ps1 -OutputFile AutoPilotHWID.csv</p>
</blockquote>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5443" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices-2.png" alt="PowerShell.PNG" width="572" height="500"></p>
<p><img class="alignnone size-full wp-image-5443" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices-2.png" alt="PowerShell.PNG" width="572" height="500"></p>
<p class="wp-caption-text">Basic PowerShell commands will allow you to extract the unique Hardware Identifier (HWID) for your existing device – this is required for AutoPilot to run</p>
</div>
<p>With the HWID obtained, the process to complete the configuration of AutoPilot is easily followed by these step by step<span> </span><a target="_blank" href="https://docs.microsoft.com/en-us/intune/enrollment-autopilot" rel="noopener noreferrer">instructions here</a>, but largely consist of the following steps:</p>
<ol>
<li>Add your devices (HWID) into Intune</li>
<li>Create an AutoPilot Device Group (tells Intune which devices in your organisation should be managed by AutoPilot). Note you can do both static and dynamic rules for adding devices here.</li>
<li>Create an AutoPilot Deployment Profile – this is the configuration settings you want to choose and allows you to skip a number of the standard Win10 decisions that need to be made when a device is being set up for the first time.</li>
<li>Assign an AutoPilot Deployment Profile to a Device Group – this matches what you’ve created in Step 2 with Step 3</li>
<li>Assign a user to a specific AutoPilot Device – this optional step allows you to match a user in your organisation with a specific device. The net result of this is the first time the user turns on the computer and connects it to the internet their name and email address is pre-populated in the setup process, meaning they only need to confirm their password during the setup – very cool!</li>
</ol>
<p>The documentation I’ve linked to is pretty clear – it took me about thirty minutes to follow along and set the above up the first time I ran it.</p>
<h2>Enrolling Your Device</h2>
<p>Now the fun really beings. With the configuration completed, you can take your brand new ‘out of the box’ device and enroll it using AutoPilot for a truly streamlined, managed experience.</p>
<p>I took some photos of the experience using my phone camera (photo quality is average) and anyone that has ever set up Windows 10 will be familiar with this process:</p>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5444" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices.jpg" alt="2019-03-01 15.09.13" width="572" height="368"></p>
<p><img class="alignnone size-full wp-image-5444" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices.jpg" alt="2019-03-01 15.09.13" width="572" height="368"></p>
<p class="wp-caption-text">A user must always choose their region</p>
</div>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5445" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices-1.jpg" alt="2019-03-01 15.09.31" width="572" height="324"></p>
<p><img class="alignnone size-full wp-image-5445" src="http://www.sickgaming.net/blog/wp-content/uploads/2019/03/how-autopilot-helps-schools-manage-shared-devices-1.jpg" alt="2019-03-01 15.09.31" width="572" height="324"></p>
<p class="wp-caption-text">Keyboard preference remains a requirement</p>
</div>
<p><img class="lazyload alignnone size-full wp-image-5446" src="https://i1.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.09.41.jpg?resize=596%2C339&ssl=1" alt="2019-03-01 15.09.41" width="595" height="339"></p>
<p><img class="alignnone size-full wp-image-5446" src="https://i1.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.09.41.jpg?resize=596%2C339&ssl=1" alt="2019-03-01 15.09.41" width="595" height="339"></p>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5447" src="https://i2.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.10.17.jpg?resize=596%2C370&ssl=1" alt="2019-03-01 15.10.17" width="572" height="355"></p>
<p><img class="alignnone size-full wp-image-5447" src="https://i2.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.10.17.jpg?resize=596%2C370&ssl=1" alt="2019-03-01 15.10.17" width="572" height="355"></p>
<p class="wp-caption-text">At this point, once the device is connected to the internet it will automatically join AzureAD and enroll into Intune because the HWID is registered with your tenant. Further Win10 setup steps can be optionally skipped at this point based on the Autopilot Profile configuration.</p>
</div>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5448" src="https://i1.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.10.30.jpg?resize=596%2C370&ssl=1" alt="2019-03-01 15.10.30" width="572" height="355"></p>
<p><img class="alignnone size-full wp-image-5448" src="https://i1.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.10.30.jpg?resize=596%2C370&ssl=1" alt="2019-03-01 15.10.30" width="572" height="355"></p>
<p class="wp-caption-text">The device immediately starts to configure based on AutoPilot Deployment Profile you’ve created and assigned to the Device Group</p>
</div>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5455" src="https://i1.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-08-11.43.43.jpg?resize=596%2C339&ssl=1" alt="2019-03-08 11.43.43" width="572" height="325"></p>
<p><img class="alignnone size-full wp-image-5455" src="https://i1.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-08-11.43.43.jpg?resize=596%2C339&ssl=1" alt="2019-03-08 11.43.43" width="572" height="325"></p>
<p class="wp-caption-text">This screenshot shows AutoPilot busily configuring the device and giving progress updates – the time this takes varies based on how many apps you’ve chosen to push to the device.</p>
</div>
<div class="wp-caption alignnone">
<p><img class="lazyload alignnone size-full wp-image-5450" src="https://i2.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.12.38_LI.jpg?resize=596%2C335&ssl=1" alt="2019-03-01 15.12.38_LI" width="572" height="321"></p>
<p><img class="alignnone size-full wp-image-5450" src="https://i2.wp.com/samuelmcneill.com/wp-content/uploads/2019/03/2019-03-01-15.12.38_LI.jpg?resize=596%2C335&ssl=1" alt="2019-03-01 15.12.38_LI" width="572" height="321"></p>
<p class="wp-caption-text">Done! Note the following: 1) School logo is displayed 2) User is greeted by name if the device is specifically assigned to a user 3) The school/organisation name is displayed; 4) The user’s email address is displayed 5) A customisable welcome message is displayed with contact details for assistance.</p>
</div>
<p>At this point, the device settings and applications are installed (or possibly still coming down over the internet) but the device is ready for us.</p>
<p>The end user had minimal choices and actions required of them:</p>
<ol>
<li>Choose their country</li>
<li>Choose their keyboard</li>
<li>Connect to the internet (this could even be their home WiFi)</li>
<li>Enter their organisation password (Office365)</li>
</ol>
<h2>My Thoughts</h2>
<p>Modern deployment relies on the cloud for identity and provisioning of devices – there are no on-premise servers in the above model. This allows for fast, flexible and lower cost management of devices – something that appeals to education institutes where every dollar counts!</p>
<p>Whilst I’ve gone through the configuration pretty quickly above, along with a high level ‘rationale’ of why you’d want to do this, the next post will go a bit deeper into when to use Intune vs Intune for Education, and a couple of tweaks to make your devices run even faster at sign in and have key applications appear instantly whenever a new user signs in. I’ll likely post this in the next week or so.</p>
</div>