Loading...

Automatically adding devices to an Azure AD group when Autopilot completes with PowerShell and Azure Automation


In this post we will see how to use PowerShell and Azure Automation to automatically add a device when Windows Autopilot is successfully completed.


Context

See below what we want:

- Install devices with Autopilot

- Deploy things only when Autopilot completes

- Add them into a specific group after Autopilot completes


Autopilot and end time

One week ago, someone sent me a mail to ask if have a solution to know when Windows Autopilot has completed.

I sent him some links we will see below, then he sent me a picture with an interesting thing.

Indeed in Monitor > Autopilot deployments you will get information about Deployment end time.

I admit I completely missed this one, so when I saw this my brain was like oh boyyyy wake up


Thanks Andreas for pointing me to this direction


The solution

After giving a look to the monitor report, I started playing with MS Graph and PowerShell to find the appropriate resource.

To know when a new autopilot devices is completely installed the resource to use is: deviceManagement/autopilotEvent

See below through the monitor portal part:


See below through now result using Graph and PowerShell:


The idea is now to automatically add devices from there into a specific Azure AD group.

To do this automatically we will use Azure Automation.


In the script you can choose to add devices in the group as below:

- All devices from the Monitor part

- Only devices installed during last x hours

- Only devices installed during last x days


What does the script ?

The automation script will proceed as below:

1. Get all devices from autopilot devices

OR

1. Get all devices from autopilot devices installed last x hours/days

2. Get the approriate serial number

3. Get the appropriate ID using the serial number

4. Add the device to an Azure AD group using its ID


Get the script

Click on the below GitHub picture to get the script



How to use the script ?

Adding group ID

The idea is to add the device to an Azure AD group when Autopilot is finished.

For this add the group ID into the variable: $Deployment_Completed_Group_ID


Managed identity

The Azure Automation script works with a managed identity.

To make it simple a Managed identity is an Azure AD account that will be used to

We will see later how to use it.


Choose how to add devices

As mentioned previously, youcan choose to add devices as below:

- All devices from the Monitor part

- Only devices installed during last x hours

- Only devices installed during last x days


In the script you will have to comment/uncomment only the part you want.

See them below:



Azure Automation account

Create the account

1. Go to Azure

2. In the search bar type: Automation accounts

3. Go to Automation accounts


4. Click on Create

5. Type a name

7. Choose a Subscription


8. Choose the Resource group

10. Choose your region


12. In Create Azure Run As Account, select No


13. Click on Create

15. Click on Go to resource



Add modules

1. Go to your automaton account

2. Click on Modules gallery


3. Search: az.Accounts

4. Click on az.Accounts


5. Click on Import


6. Click on OK

7. Wait for importing


Set Managed Identity

1. Go to your automation account

2. Go to Identity (Preview)


3. Go to System assigned

4. Select On


5. Click on Save

6. Click on Yes


Add a group owner

1. Go to your group

2. Go to Owners

3. Add the automation account


Azure Automation Runbook

Create a Runbook

1. Go to Azure

2. In the search bar type: Automation accounts

3. Go to your Automation accounts

4. Go to Runbooks


5. Click on + Create a runbook


6. Type a name

7. In Runbook type, select PowerShell

8. Click on Create


Add script in Runbook

The runbook script is located downloaded sources

Add the group ID in the variable $Deployment_Completed_Group_ID.


Test the Runbook

1. Click on Test pane

2. Click on Start

3. Once finished, you should see Completed


Publish the Runbook

1. Go to your Runbook

2. Click on Edit

3. Click on Publish

4. Click on Yes


Schedule the Runbook

1. Go to your Runbook

2. Click on Schedules

3. Click on + Add a schedule

4. Click on Link a schedule to your runbook

5. Click on + Add a schedule

6. Type a schedule name

7. In Recurrence, select Recuring

8. Click on Create


Other solutions

See below some posts from the awesome Niall Brady who uses another solution to do this:

Displaying a welcome page after Windows Autopilot completes

Adding devices to an AAD group after windows autopilot completes part1

Adding devices to an AAD group after windows autopilot completes part2



Windows Autopilot 1745417094024261535

Enregistrer un commentaire

2 commentaires

Anonyme a dit…

Hi,
I'm getting error:

Invoke-WebRequest : The remote server returned an error: (401) Unauthorized. At line:37 char:25

Anonyme a dit…

Completed

Environments
------------
{[AzureChinaCloud, AzureChinaCloud], [AzureCloud, AzureCloud], [AzureGermanCloud, AzureGermanCloud], [AzureUSGovernme...
The remote server returned an error: (401) Unauthorized.
Cannot bind argument to parameter 'InputObject' because it is null.
The remote server returned an error: (401) Unauthorized.
Cannot bind argument to parameter 'InputObject' because it is null.
The remote server returned an error: (403) Forbidden.
Cannot bind argument to parameter 'InputObject' because it is null.

Accueil item

Award

Sponsors

Join me soon in live

Yo want to support me ?

Mes articles en français

Endpoint Manager award

Author of Books

Stats