IT Services Reference
Powered by

Autopilot Registration

In 

Review the DeployR Autopilot-registration setup using the recorded CCM app registration and certificate authentication. The certificate is created on the DeployR server and its public portion is used later in the sequence.

In DeployR there is a step that can be added to a task sequence that registers the device to Autopilot automatically. This will upload the device Hardware Hash and assign a Group Tag for V1, or Upload the Corporate Device Identifier for V2.

Entra App Registration

The Autopilot registration step uses CCM: DeployR Deployment Server app registration, which already has the appropriate permissions.

The Entra App Registration uses certificate authentication. This requires creating a Self Signed certificate on the DeployR server which is stored in the servers certificate store.

To enable DeployR to use the App Registration for the purposes of Autopilot do the following.

  1. Create a Self Signed Certificate
  • On the DeployR Server run the following powershell code.
  • Change the variables as required before running.
  • This will create a new self signed certificate, write the certificate thumbprint to console output and export the public certificate as a DER cert, which is required in a later stage.
  • Make a note of the certificate thumbprint from the console.

# Create-Self-Signed-Certificate

### Declare some Variables

# Change these variables as required.

[string[]]$DPRFQDN = @("deployr.cornerstone.wa.edu.au", "app-dpr1.cornerstone.wa.edu.au") # This MUST include the FQDN chosen for the DeployR installation. The captured example also includes the actual server name.

$ValidYears = 10 # Number of years the certificate is valid.
$ExportLocation = "C:\a\DeployRAutoPilotRgistrationEnterpriseApp.cer" # This is the full path and filename of the exported file. Change as needed.
$CertFriendlyName = "DeployR Autopilot Registration Enterprise App" # Not critical but helpful.

# DO NOT Change these variables.

$CertStoreLocation = "Cert:\LocalMachine\My" # Local machine certificate store.

$Validity = (Get-Date).AddYears($ValidYears)

$NewCert = New-SelfSignedCertificate -DnsName $DPRFQDN -CertStoreLocation $CertStoreLocation -NotAfter $Validity -FriendlyName $CertFriendlyName

Write-Output $NewCert.Thumbprint

$NewCert | Export-Certificate -Type CERT -FilePath $ExportLocation

  1. On the DeployR Server
  • Open the Configure DeployR app from the start menu.
  • Click the Show Advanced button to reveal the Entra ID Settings
  • Enter the CCM Entra Tenant ID
  • Enter the Enterprise App application ID - a078d915-26c6-4555-8e53-be1f6e04aaac
  • Enter the Entra ID cert thumbprint from the previous step.
  • Verify and Save settings.
  • Add the public certificate to the Entra Enterprise App
  • Open Entra App Registrations
  • Open CCM: DeployR Deployment Server app
  • Select Certificates & Secrets
  • Select Certificates and click Upload
  • Browse to the exported certificate from Step 1.
  • The DeployR server now has permissions to register devices in Autpilot.
  1. Configure the Register with Autopilot step in the Task Sequence
  • In DeployR open your task sequence.
  • Enter Edit mode and click on the Register with Autopilot step (or add it).
  • Select your Windows Autopilot version.
  • V1
  • Enter the Group tag you want assigned.
  • Leave the Entra ID Group Name blank if you already use Dynamic groups in your deployment profiles.
  • Select the Wait for Autopilot (v1) profile.
  • V2
  • Leave the Group tag, Entra ID group name and Wait for Autopilot profile. They are only relevant for V1
  • Now when you image a device it will automatically be registered with Autopilot, either V1 or V2 as selected.
  • If the device already exists in V1 or V2 DeployR will simply carry on.
  • Place this step towards the end of the task sequence.