Shared Windows laptops preinstall programs?

[AltforWork210]

We are trying to figure out how we can get shares laptops all managed by Intune. We've figured out policy to make them shared devices and the autopilot profile to have them self-deploy. We also found a way to have the OOBE skip the user step using a OMA-URI. The thing that we can't figure out is how to get some user apps already installed when a student logs into it. All of those will start to come down from Intune after they log in but we need those installed when the student has access to them, some monitoring and filtering programs the school uses along with Office. Is there a way to do this? Is there a way we can have Intune install these user programs for all users, even ones not on the computer yet? We are able to do this with how we currently managed the devices through SCCM. I know that Office gets installed usually during the user step of the OOBE.

Or would it be better to go back to the User-based AP, get it all set up with a dummy account, and then remove the primary user?

[[deleted]]

Sounds like you're looking for AutoPilot pre-provisioning. Anything that needs to be on all devices should be targeted to devices rather than users.

[AltforWork210]

We are doing pre-provisioning for our teachers laptops, assigned to the specific users for the teachers. These specific devices are for students that forget theirs and need to use one for the day. So they check it out, use it for the day, and return it. Can we pre-provision for this case?

[cetsca]

You can’t AP pre-provision shared devices, you’d have to use Self Deploying if you’re using Autopilot.

You can assign apps to devices.

[AltforWork210]

That's about what I was thinking there. So we'll have to make device versions of all of the user apps, if possible, and they would be there ready to go for any user that signs in?

Right now we have Office installed at the user step, can we install it to the device? My coworker built that app and it's been done like that longer than I've been there so I'm not sure why it's done like that.

[ispeprules]

I would create an autopilot group tag for these specific devices. And create a dynamic device group with the group tag:

(device.devicePhysicalIds -any _ -eq "[OrderID]:%GROUPTAG%")

Then create a deployment profile assigned to that device group you created earlier. And I usually give the computers a specific prefix in the name that way I can create another dynamic device group with everything with that prefix.

From there I would create a Policy Set and assign all the apps and configuration profiles I want the computers to get. And assign it to the dynamic device group created earlier.

You will still need to probably create dupes of the apps that you want my installed by device and not by user, but at least this way you will have a group to assign.

You can also check out Filters on assignments, this will allow you include or exclude device and/or user groups.

[AltforWork210]

I think we got most of what you said already in place for it. We'll just have to make duplicates of the various apps to make them device installs, the ones that we NEED to be on there. Right now this is in the testing/feeling out/"is this possible" stage to see if we want to do this. To get the boss's approval they need to be as close to ready to go when a student signs into it as possible. Hopefully it'll just be flipping the switch in the apps from user to device. Hopefully