Hybrid Working - the new normal

If you are up with the latest modern workforce trends, it looks like remote (or hybrid) working is here to stay, with a sizeable percentage of workers electing to work from home and only coming to the office 1 or 2 days per week. The ability to quickly get your workforce up and running, and to support them at a sustainable cost, has never been more important. What makes it difficult for business, is that their employees are now working largely from home, which includes the IT team.

Zero Touch Deployment is an approach that allows your business to purchase new Windows devices, have them delivered directly to your employees (wherever they may be), and then after the employee logs into the device with their work credentials, the device is automatically configured over the air with work security/settings, apps, and access to data. It all takes about 30-45 minutes, and the IT team is not involved in the device setup. Users are truly empowered.

There are 2 components required to enable your business to enable Zero Touch Deployment – namely Windows Autopilot and Microsoft Intune.

• Windows Autopilot - is a cloud-based deployment technology which allows you to deploy and configure Windows 10/11 devices over the internet from any location, and with no IT specialist involvement required during the device setup process. Windows Autopilot is built on existing modern management technologies like Azure Active Directory (Azure AD) and Microsoft Intune to manage and configure devices by automatically enrolling in these solutions at their first bootup, right out of the box.

• Microsoft Intune - is a cloud-based service that focuses on mobile device management (MDM) and mobile application management (MAM). Intune integrates with Azure Active Directory (Azure AD) to control who has access and what they can access. It can be used with the Microsoft 365 suite of products. For example, you can deploy Microsoft Teams, OneNote, and other Microsoft 365 apps to devices. This feature enables people in your organisation to be productive on all their devices while keeping your organisation’s information protected with the policies you create which can be specific to each type of device (Windows, Mac, iOS, Android) or ownership type (Corporate or Personal).

Explore Digital offers Zero Touch Deployment setup services for each of the above services (Windows Autopilot and Microsoft Intune). Each are provided as independent offerings to provide flexibility in configuration, as some businesses may already have Intune deployed and wish to now support Windows Autopilot. Windows Autopilot setup does however require Intune to be in place. Licensing is also a requirement and can either be already in place (often bundled with your existing Office/Microsoft 365 E3 or Microsoft 356 Business Premium licenses), but again can be purchased separately as an additional part of the Zero Touch Deployment engagement.

Note

1. If you need help to establish an Azure tenant and procure the required licenses, we are an authorised Microsoft Cloud Solution Partner (CSP) and can help to confirm what you need up front and then provide a bespoke quotation for Azure tenant setup and licensing subscriptions.

2. If you already have an Azure tenant, but perhaps have not yet set up Intune, this is an additional service we can also assist you with in terms of modern workplace design and deployment services. This can start out as a simple deployment or even a pilot, and we can expand the scope of the design over time. Again, if you need Intune licenses, as a Microsoft CSP we can help you there as well.

See notes below regarding Microsoft’s licensing requirements for Intune and Autopilot.

Scope of Work (SOW) for this service:

The following items are included in the Scope of Work (SOW):

• Kick-off meeting (remote)

• Create a project plan and schedule

• Confirm in-scope devices meet Autopilot and Intune requirements

• Confirm network connectivity requirements meet Autopilot and Intune requirements

• Confirm existing licensing meets Autopilot and Intune requirements

• Confirm client has granted required permissions/authorisation to Explore Digital to register devices as a CSP reseller

• Provide tool to collect the hardware IDs from existing devices

• Register devices to Windows Autopilot

• Configure automatic MDM (Intune) enrolment on existing Azure AD

• Configure company branding for use during OOBE (client to provide images of required dimensions, file size and format)

• Creation of Azure AD groups (dynamic device security group) for all new Autopilot devices

• Configure Autopilot deployment profile

• Enable enrolment status page (this allows end user to see the enrolment status page including assigned apps and profiles during Autopilot provisioning)

• Within Intune - Configure a selection of up to 5 device configuration profiles with basic settings, also deploy a selection of Microsoft 365 Apps as per existing licensing

• Within Intune - Configure a selection of up to 5 Windows configuration profiles with basic settings (e.g. Outlook, Delivery Optimisation)

• Within Intune – Configure Device Firmware Configuration Interface (DFCI) management of Surface UEFI settings (unique to Surface and available on specific models)

• Within Endpoint Manager - Configure Update Rings, Feature updates and Quality updates for Windows 10 and later (Preview)

• Within Endpoint Manager - Configure up to 3 Windows 10/11 compliance policies (non-complex)

• User assignment to the specific Autopilot-enabled devices

• Provide advice to customer for preparing devices to be in an OOBE state and on the minimum required version of Windows 10 (1903 or higher)

• Demonstrate device reset and re-assignment to another user, device repair preparation (de-register from Windows Autopilot and DFCI, followed by device enrolment once it has been repaired)

• Offer advice on implementation issues, if any

• Project closure and acceptance

The following configuration is explicitly excluded from this engagement:

• Configuration of Azure AD Connect and identity synchronisation between Active Directory Domain Services (AD DS) and Azure Active Directory (Azure AD)

• Initial setup and/or configuration of Intune (other than for the above scoped items)

• Setup and.or configuration of Configuration Manager and/or co-management

• Configuration of mobile devices (iOS or Android) and/or related setup within Intune

• Configuration of Conditional Access with Microsoft Intune compliance policies

• Deployment of certificates to devices using Intune and/or Certificate Connector for Microsoft Intune

• Configuration of Windows Store for Business

• Kiosk setup within Autopilot and/or Intune

• Group Policy ADMX settings and related deployment and/or migration of any existing Group Policies

• Remote control of devices (e.g., Teamviewer, Splashtop etc)

• Configuration of Desktop Analytics

• Configure eSIM cellular profiles in Intune (public preview)

Licensing requirements

Windows Autopilot depends on specific capabilities available in Windows client and Azure Active Directory (Azure AD). It also requires an MDM service such as Microsoft Intune. These capabilities can be obtained through various editions and subscription programs. To provide needed Azure Active Directory (automatic MDM enrollment and company branding features) and MDM functionality, one of the following subscriptions is required:

• Microsoft 365 Business Premium subscription (** NOTE - This is the most common license we see with our SME clients and provides all you need for Windows Autopilot and Intune **)

• Microsoft 365 F1 or F3 subscription

• Microsoft 365 Academic A1, A3, or A5 subscription

• Microsoft 365 Enterprise E3 or E5 subscription - which include all Windows client, Microsoft 365, and EMS features (Azure AD and Intune).

• Enterprise Mobility + Security E3 or E5 subscription - which include all needed Azure AD and Intune features.

• Intune for Education subscription - which include all needed Azure AD and Intune features.

• Azure Active Directory Premium P1 or P2 and Microsoft Intune subscription.

The end user device must be running a supported version of Windows 10 or Windows 11 running the either of the following editions: Pro, Pro Education, Pro for Workstations, Enterprise, and Education.

NOTE

• Windows 10/11 Home is insufficient for use with Intune, Windows Autopilot, plus a bunch of other services typically required for business use.

• Always consider the benefits of buying the ‘Surface for Business’ line of products and not consumer-grade products from the big-box retailers - there’s a big difference!

• Explore Digital is an Microsoft-authorised business-only reseller - so please take a look on our ‘Explore Surface’ online store for your next business-related device purchase.

• For a list of OEMs that currently support Windows Autopilot, see the Participant device manufacturers section at Windows Autopilot

• All products, services, or combination of products and services supplied by Explore Digital Pty Ltd are covered by our warranties - detailed here.