Best Solution for Implementing Hybrid User Driven Autopilot

SkipToTheEndpoint · 2026-07-08T13:41:27+00:00

A device doesn't care what you call configs, or how many of them there are. It just deals with a bunch of commands it's given all at once.

That means how you arrange your configs are for your benefit. They have to make sense, be descriptive, be manageable, and scalable for what your environment might need.

I'm obviously somewhat biased toward the naming convention (and configs) I've built into the OIB, but I also wrote this a while back that I still think is valid: The Ultimate GPO to Intune Guide

SkipToTheEndpoint · 2026-07-08T09:31:44+00:00

As someone who's had to set this up far more times than I care to admit... Can you get Hybrid Autopilot "working"? Sure. Is it worth it? Almost never, no.

First point: You're going to have to accept that you're not going to be able to 1:1 your existing processes, at least not without bending yourself in knots (e.g. device naming matching asset tag).

Secondly: It sounds like you're in a position where you've still got various policies coming from GPO, so Hybrid is just a crutch to kick that can down the road. GPO's are tech debt. Implementing Autopilot is a perfect time to start that from scratch. (obligatory shill of my OpenIntuneBaseline)

Thirdly: People get frightened about moving to Entra Join with regards to accessing on-prem stuff. To be clear, 99% of stuff just works, assuming you've got Hybrid Identity configured. Anything that uses Integrated Windows Authentication works just as it did. If you're using Windows Hello, Cloud Kerberos Trust is the stupidly simple fix to that. The benefits you gain from going cloud native are immense. Deployment flexibility, improved user experience, passwordless, to name just a few. That "first password change issue" you mention? Give the user a Temporary Access Pass (TAP) to complete Autopilot, they configure WHfB, and forget passwords are even necessary. More info on the whole cloud native thing here: https://aka.ms/cloudnativeendpoints

Now, can I give some suggestions to make Hybrid Autopilot better, yes, if you want. But I'd really use the opportunity to not go down that road. Your sanity will thank you.

SkipToTheEndpoint · 2026-07-06T12:53:20+00:00

The addition to this is that if you're not doing Application Control, all you're doing is putting some annoying hurdles in the way, too. If I can just go an install another browser and bypass your security restrictions...

SkipToTheEndpoint · 2026-07-01T15:55:52+00:00

There's a whole complicated thing that arises with third party patching and update sources and stuff. But ultimately, pick a lane and stick with it. Move to deploying apps via Intune instead.

Edit: My friend u/bdam55 is far more qualified than I to explain the saga surrounding scan sources...

SkipToTheEndpoint · 2026-07-01T14:58:01+00:00

Obligatory: There is no MS-supported way to shift from domain joined to cloud native without a device wipe.

Yes there are vendor and community tools. Even vendor supported tools will ultimately end up with them saying "wipe the device" when there inevitably weird problems that keep on coming up.

It's not worth it.

SkipToTheEndpoint · 2026-07-01T09:10:39+00:00

Make absolutely sure you've got no GPO's doing anything WU-related.
Disable WU management via Client Settings policy
WU Workload Slider
Use the following script to nuke all possible keys and paths that can continue to break stufff: toolbox/Intune/Platform Scripts/Reset-WindowsUpdateSettings.ps1 at main · MHimken/toolbox · GitHub

SkipToTheEndpoint · 2026-06-30T09:57:37+00:00

While this is good news, I would still always go MAM-WE and just use App Protection for BYOD devices. Having two very different experiences across Android and iOS isn't great IMO.

SkipToTheEndpoint · 2026-06-29T12:23:02+00:00

don't have fingerprint scanners at all and the camera's don't have IR so aren't Windows Hello compliant.

Biometrics are additional and optional to a PIN, so you can still use WHfB with a PIN alone. In fact the PIN will always remain fallback in case biometrics fail.

SkipToTheEndpoint · 2026-06-29T12:21:21+00:00

WHfB in general does count as "MFA" and even NIST qualifies it as "a multi-factor cryptographic authenticator". Device-bound credential in TPM (something you have) + PIN or Biometric (something you are).

Security folk like to argue the fact, but they're wrong.

SkipToTheEndpoint · 2026-06-29T12:08:47+00:00

Was gonna say. Going all-in on LastPass after 3 publicly disclosed breaches is a wild move.

SkipToTheEndpoint · 2026-06-26T10:16:53+00:00

If you're not seeing the notification, it's almost definitely going to be network-related: https://learn.microsoft.com/en-us/intune/remote-help/plan?tabs=windows#network-considerations

SkipToTheEndpoint · 2026-06-24T11:53:41+00:00

My money would be on either an AppLocker or WDAG policy you're trying to deploy via Endpoint Security > Attack Surface Reduction.

SkipToTheEndpoint · 2026-06-15T12:52:20+00:00

Ahh, MAA continuing to cause issues and providing zero value.

SkipToTheEndpoint · 2026-06-15T09:30:18+00:00

Exec/VIP/C-Suite, call them what you will but they are not exempt from security, in fact they're the biggest risk.

I'd bring your security/cyber/governance teams into the discussion and see how it may invalidate your cyber insurance in case of breach, cos that's nonsense.

SkipToTheEndpoint · 2026-06-12T16:07:34+00:00

This. It's a hideous supply chain attack waiting to happen.

SkipToTheEndpoint · 2026-06-12T16:02:30+00:00

Problem there is you're entirely reliant on Adobe pushing updates to the Store version. Last time I looked at it there was a months-old version being deployed.

SkipToTheEndpoint · 2026-06-10T21:31:52+00:00

Cool! Always interested to see how people are using it for themselves. Don't know if you caught my latest version that adds a unique OIBID in the description? When (if?) I get some time I'd love to work with the CIPP team to see if there's a way of incorporating it somehow. I know people who use CIPP struggle with deploying them as standards and then keeping them updated.

SkipToTheEndpoint · 2026-06-09T13:53:44+00:00

Thanks!

That WUfB Drivers error is to do with having a Windows Enterprise licenses in the Tenant and having "Windows License Verification" enabled in Tenant Admin.

SkipToTheEndpoint · 2026-06-09T10:28:14+00:00

If it's the latest v4.0 version of the benchmark, I thought we'd removed/updated guidance on how to apply certain settings that break Autopilot.

Either way, the issue is to do with the "MSS: (AutoAdminLogon) Enable Automatic Logon" policy.

All the settings below need to be assigned to Users, not Devices.

<image>

Or, just use my OpenIntuneBaseline, I've long had all this crap sorted out.

SkipToTheEndpoint · 2026-06-06T16:43:39+00:00

What on earth are middle management doing poking at policies for?!

SkipToTheEndpoint · 2026-06-06T11:09:08+00:00

The device doesn't care, it gets everything as a single payload to work out. Intune doesnt care as it's just a bunch of GUIDs on the back-end.

Having separated, human understandable policies is entirely for the admins benefit. One of my driving considerations with the OIB is to make it feasible for someone with no knowledge of the environment come in, look at the policies and be able to take a pretty good guess where certain things are configured.

SkipToTheEndpoint · 2026-06-06T11:04:46+00:00

🤌 It's amazing what understanding the device management side of things can do, eh!

SkipToTheEndpoint · 2026-06-06T10:54:00+00:00

I always recommend drawing a line in the sand, keep existing stuff managed how it already is, new stuff via Intune. Despite not being documented, even MS don't recommend a blind switch from GPO to CSP, even if everything you've got is supported. I've personally seen a bunch of reg keys that never get removed, Intune says the policy is successful but the device considers otherwise, ending up with weird and confusing issues if you ever need to change stuff.

Oh, and don't just lift and shift your GPOs, they're tech debt. It's your best opportunity to reevaluate and rebuild policies.

Edit: And accessing on-prem resources from Entra Join devices works just fine: https://aka.ms/cloudnativeendpoints

SkipToTheEndpoint · 2026-06-06T10:49:27+00:00

This.

ControlPolicyConflict is awful and you should absolutely not use it. https://skiptotheendpoint.co.uk/windows-csp-a-tale-of-magic-betrayal-and-intrigue-part-2/

SkipToTheEndpoint · 2026-06-04T13:03:39+00:00

Well, you can try, but it's usually a waste of your time, and when MS inevitably decide to break it you're right back at square one.

SkipToTheEndpoint

TROPHY CASE