Tutorial: Entra Join a Windows Device¶

# Verify device settings
Connect-MgGraph -Scopes "Policy.Read.All"

$deviceSettings = Get-MgPolicyDeviceRegistrationPolicy
$deviceSettings | Select-Object DisplayName, MultiFactorAuthConfiguration,
    @{N="JoinScope"; E={$_.AzureADJoin.AllowedUsers}}

# Run on the target device (as Administrator)
# Install the script
Install-Script -Name Get-WindowsAutoPilotInfo -Force

# Collect hardware hash
Get-WindowsAutoPilotInfo -OutputFile "$env:TEMP\autopilot-device.csv"

# Display the CSV content
Get-Content "$env:TEMP\autopilot-device.csv"
# Output: Device Serial Number, Windows Product ID, Hardware Hash

# Via Microsoft Graph API
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"

$profile = @{
    "@odata.type" = "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile"
    displayName = "CSA-in-a-Box Standard Entra Join"
    description = "Standard Entra Join profile for data platform users"
    language = "en-US"
    extractHardwareHash = $true
    deviceNameTemplate = "CSA-%SERIAL%"
    outOfBoxExperienceSettings = @{
        "@odata.type" = "microsoft.graph.outOfBoxExperienceSettings"
        hidePrivacySettings = $true
        hideEULA = $true
        userType = "standard"
        hideEscapeLink = $true
        skipKeyboardSelectionPage = $true
        deviceUsageType = "singleUser"
    }
    enrollmentStatusScreenSettings = @{
        "@odata.type" = "microsoft.graph.windowsEnrollmentStatusScreenSettings"
        hideInstallationProgress = $false
        allowDeviceUseBeforeProfileAndAppInstallComplete = $false
        blockDeviceSetupRetryByUser = $true
        allowLogCollectionOnInstallFailure = $true
        installProgressTimeoutInMinutes = 60
    }
}

$createdProfile = New-MgDeviceManagementWindowsAutopilotDeploymentProfile `
    -BodyParameter $profile

Write-Host "Profile created: $($createdProfile.DisplayName)"
Write-Host "Profile ID: $($createdProfile.Id)"

# Create a dynamic device group for Autopilot devices
$groupParams = @{
    displayName = "CSA-Autopilot-Devices"
    description = "Dynamic group for Autopilot-registered devices"
    groupTypes = @("DynamicMembership")
    membershipRule = '(device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))'
    membershipRuleProcessingState = "On"
    securityEnabled = $true
    mailEnabled = $false
    mailNickname = "csa-autopilot-devices"
}

$group = New-MgGroup -BodyParameter $groupParams

# Assign the Autopilot profile to the group
# Intune admin center > Devices > Enrollment > Deployment profiles
# Select profile > Assignments > Add group

# Trigger Autopilot reset from Intune
# This wipes the device and re-provisions it with Entra Join

# From Intune admin center:
# Devices > All devices > [Select device] > Autopilot reset
# The device will reboot, wipe, and enter OOBE

# Or via Graph API:
$deviceId = "managed-device-id"
Invoke-MgGraphRequest -Method POST `
    -Uri "https://graph.microsoft.com/v1.0/deviceManagement/managedDevices/$deviceId/wipe" `
    -Body '{"keepEnrollmentData": false, "keepUserData": false}'

# Step 1: Backup data
# Ensure user data is backed up to OneDrive or external storage

# Step 2: Backup BitLocker recovery key
$bv = Get-BitLockerVolume -MountPoint "C:"
$rk = $bv.KeyProtector | Where-Object { $_.KeyProtectorType -eq "RecoveryPassword" }
Write-Host "SAVE THIS KEY: $($rk.RecoveryPassword)"

# Step 3: Leave the domain (requires local admin or domain admin)
# Settings > Accounts > Access work or school
# Click on the AD domain connection > Disconnect
# OR via PowerShell:
Remove-Computer -Force -Restart

# Step 4: After reboot, join Entra ID
# Settings > Accounts > Access work or school > Connect
# Click "Join this device to Azure Active Directory"
# Sign in with Entra ID credentials (user@contoso.com)

# Step 5: Restart the device
# After restart, sign in with Entra ID credentials
# Intune enrollment happens automatically (MDM auto-enrollment configured in Step 1.2)

# Run on the migrated device
dsregcmd /status

# Expected output:
# +----------------------------------------------------------------------+
# | Device State                                                          |
# +----------------------------------------------------------------------+
#
#              AzureAdJoined : YES          <-- Entra Joined
#           EnterpriseJoined : NO
#               DomainJoined : NO           <-- NOT domain-joined
#
# +----------------------------------------------------------------------+
# | SSO State                                                             |
# +----------------------------------------------------------------------+
#
#             AzureAdPrt : YES              <-- Primary Refresh Token
#    AzureAdPrtUpdateTime : 2026-04-30 10:00:00 UTC
#    AzureAdPrtExpiryTime : 2026-05-14 10:00:00 UTC

# Check Intune enrollment status on the device
Get-ChildItem "HKLM:\SOFTWARE\Microsoft\Enrollments" |
    Get-ItemProperty |
    Where-Object { $_.ProviderID -eq "MS DM Server" } |
    Select-Object PSChildName, UPN, ProviderID, EnrollmentState

# Or check via Intune admin center:
# Devices > All devices > [Device name] > Overview
# Verify: Managed by = Intune, Compliance = Compliant

# Test SSO to Microsoft services (should not prompt for credentials)
Start-Process "https://app.fabric.microsoft.com"      # Fabric portal
Start-Process "https://app.powerbi.com"                # Power BI
Start-Process "https://portal.azure.com"               # Azure Portal
Start-Process "https://web.purview.azure.com"          # Purview

# Each should sign in automatically using the Primary Refresh Token
# If prompted for credentials, verify:
# 1. dsregcmd /status shows AzureAdPrt: YES
# 2. Edge is signed in with the same Entra ID account
# 3. No Conditional Access policy is blocking access

# Check device compliance from the device
# Settings > Accounts > Access work or school > [Connection] > Info
# Verify: Device compliance = Compliant

# Via Graph API (from admin context):
$device = Get-MgDeviceManagementManagedDevice -Filter `
    "deviceName eq 'CSA-DEVICE01'"

$device | Select-Object DeviceName, ComplianceState,
    LastSyncDateTime, OperatingSystem, AzureADRegistered,
    @{N="Management"; E={$_.ManagementAgent}}

# Verify BitLocker recovery key is in Entra ID
# Entra admin center > Identity > Devices > All devices > [Device] > BitLocker keys

# Or via Graph API:
$deviceObjectId = "device-object-id-from-entra"
$keys = Get-MgInformationProtectionBitlockerRecoveryKey -Filter `
    "deviceId eq '$deviceObjectId'"
Write-Host "BitLocker keys escrowed: $($keys.Count)"

# Force Intune sync (if enrollment stalled)
Get-ScheduledTask | Where-Object { $_.TaskName -like "*Intune*" -or $_.TaskName -like "*MDM*" } |
    Start-ScheduledTask

# Clear Windows token broker cache (if SSO issues)
# Settings > Accounts > Access work or school > [Connection] > Disconnect
# Then re-connect