This is from a New Zealand context and you can read more detail about the event here from the NZ History website. It was shared with me by Mike Shorter, the Director of eLearning at Bethlehem College located in Tauranga near the original battle of Gate Pa.
In Mike’s words:
It was an awesome unit and went way longer than planned! We split the class into Characters, Landscapers, Builders, Clothing and Weaponry. The students then did a mini inquiry on what was required of their group, researched their area and then we made a class timeline of when things needed to be created … The plan all along was to make it interactive and let people try to recreate the battle rather than just make a static representation. To do this we had 20 English Soldiers and 4 Maori warriors (one being Heni Pore) both start at a spawn point and the English then used the cannon to blow a hole in the defences and attack.
This was build using the Minecraft Java Edition as at the time, the Minecraft:Education Edition did not exist. Mike has kindly agreed to share his unit planning for this below:
As you can see from the video above, the students accurately re-created the battle scene, building out the fortified Pa site and then staged a recreation of the attack.
A History Of Singapore Riots
Most people know Singapore to be a very peaceful country and yet there were a number of riots that shaped the identity of the country we know today.
As part of the December 2018 “Asia’s Next Top Coder” competition, Lee Jun Hui created a history lesson in Minecraft: Education Edition that came runner up. You can see the full details here and a walk through of his world in the above video.
Centred upon the Maria Hertogh riots in the 1950s and the Little India riot that took place in 2013, the museum not only takes players through Singapore’s defining moments of days past, it also brings them along an immersive journey by combining key elements of Singapore’s heritage with technology to help them to understand the importance of harmony in a multi-racial, multi-religious society like Singapore.
Jun Hui shares the code he included in his Minecraft:EE world to animate the various riot events. Credit.
My Point Of View
Minecraft: Education Edition is the perfect tool for digitally recreating historical events and places, so much so that there are pre-built lessons to help teachers do exactly this which you can access here. I particularly like the above examples as it’s localized, “place based learning” for the students from Singapore and New Zealand allowing them to think differently about the events that have shaped the identity of their country.
Identity: Players build a sense of identity throughout the video game, either through direct input or as an on-screen character they inherit
In both of the examples above, but particularly the Battle of Gate Pa, students get to recreate elements of history and are assuming a new identity to do this – this places them right in the middle of the action and the adventure, driving deep learning.
Production: Players are producers, not just consumers: they are “writers” not just “readers”. This drives a level of engagement that more passive medias do not allow.
Again, using Minecraft allows students to recreate and “produce” both the world and the events that took place in that world – a very different learning experience compared to simply reading about an event or watching a documentary about it. Students gain a deeper understanding of how the geographical setting contributed to the historical outcome and just how hard it was to build a defensive Pa site!
Just in Time or On Demand: Players receive information as they need it, not before, which teaches them patience and perseverance and improves critical-thinking abilities. People are generally inadequately prepared to deal with lots of words out of context e.g. reading entire text books to find a single piece of information. Games provide knowledge “just in time” – school work should do the same.
In the Singapore example above, coding was required to complete the competition and so skills can be developed at that point but it’s applied contextually: in this example, how to code inside Minecraft:EE to show historical forces and events at work. When learnt in the context of an event, students are likely to retain knowledge more effectively which ties into the next point of…..
Situated Meanings: Students learn new vocabulary words by experiencing them within game situations. Research suggests learners do not acquire new vocabulary when the word is learnt purely in the context of other words. By contrast, retention is highest when words are learnt in association with an action, event, or image. Gaming provides the perfect vehicle for this.
There are many ideas and unique vocabulary from history that are not used in day to day interactions. Students in both the examples above would have needed to learn new ideas and content contextually in the world they were creating.
Cross-Functional Teams: In multiplayer environments, players have different skills, forcing them to rely on each other—a needed soft skill for students. I have seen many teachers talk about student’s developing more inter-personal skills through the use of Game Based Learning such as Minecraft: Education Edition.
In Mike’s example particularly, students were separated into groups to build different components of the world and this in itself became a mini project based learning activity. For the final battle to take place, the teams all had to work together to show case their work. This is similar to the students who worked to build a Parliament of the Future in the lead up to the 2017 New Zealand election.
Through applying the principles of effective Game Based Learning, teachers can drive deep and authentic learning outcomes but through the engaging medium of digital platforms that many students love to work in.
As I have blogged about many times before, identity is key to setting up a school successfully to enable seamless single sign on (SSO) into the wide variety of digital tools used in the modern classroom.
This morning the awesome David Colville (who largely authored this five part series on managing iPads with Intune) tipped me off to a new addition to Apple School Manager that allows for Federated Authentication of Managed Apple ID’s using Azure Active Directory (AzureAD).
As a starting point, you do need to understand what Federation means in this context, so a helpful explanation from Wikipedia is:
A federated identity in information technology is the means of linking a person’s electronic identity and attributes, stored across multiple distinct identity management systems.
Federated identity is related to single sign-on (SSO), in which a user’s single authentication ticket, or token, is trusted across multiple IT systems or even organizations. SSO is a subset of federated identity management, as it relates only to authentication and is understood on the level of technical interoperability and it would not be possible without some sort of federation
As per the explanation from Apple’s documentation:
You use federated authentication to link Apple School Manager to your instance of Microsoft Azure Active Directory (AD). As a result, your users can leverage their Microsoft Azure AD user names and passwords as Managed Apple IDs. They can then use their Microsoft Azure AD credentials to sign in to their assigned iPad or Mac and even iCloud on the web. Students can also use it to sign in on Shared iPad.
Using SAML, students would be able to use their single username/password from AzureAD to authenticate against their Apple devices, making it simple for students and easy for IT staff to manage their identity.
According to the documentation, when you federate Apple School Manager with AzureAD, Managed Apple ID’s are created automatically allowing users to sign into their Apple devices with their school email address and password.
What Is Required To Federate?
There are four main steps to link Apple School Manager to Microsoft Azure AD:
Start the federated authentication process.
Connect to your identity provider by linking Apple School Manager to Microsoft Azure AD.
Verify your Azure AD domain ownership.
Turn on and test federated authentication.
The full technical step by step guide to configuring this is available on Apple’s documentation here and I encourage you to check it out.
My Thoughts:
I have been travelling extensively across Asia and New Zealand recently but the consistent conversation that emerges is the importance for schools to get their cloud identity sorted early on, to unlock the almost limitless resources available on the internet.
Increasingly, there is inter-operability between major cloud platforms through Federated Domains and Single Sign on. AzureAD is widely supported and provides a simple way for schools to access the resources they need.
Last week I posted Part 1 of this blog series, exploring how schools can automate the configuration and deployment of their shared devices using Microsoft AutoPilot and Intune. Again, if AutoPilot is new to you, then I encourage you to watch this very short video explaining how it works:
Since writing Part 1, I also found this great blog post specifically on this topic from January 2019 which included this helpful graphic:
Overview:
As this blog post will be a little longer (and more technical) I’m going to give you a break down of what is to come so you can skip to the important sections relevant to you:
Now it’s worth stating at this stage that I am not an IT administrator by profession. Whilst I’m probably more technical than many, I’ve got the following working through a combination of relying on the detailed guides in the Microsoft Docs and awesome technical colleagues who have shared some of their expertise with me. Additionally, like you, I read a bunch of blogs to see how people have done this in the past. This blog is a small contribution to the community who like to learn from other’s experiences. If you’re reading this and are more technical than me and see some improvements or corrections in what I’ve done – I’d love to hear from you in the comments section below.
With that said, let’s get started!
Intune vs Intune for Education
Intune as a standalone Mobile Device Management (MDM) tool has been around for a long time, however Intune for Education was only launched in 2017.
A key point to clarify is that both versions use the same backend system to manage the configurations – Intune for Education is really just a simplified interface for educators to leverage. If you make a change in Intune for Education, it’s reflected in the equivalent settings inside of Intune (and vice versa).
I’ve written a more detailed blog about when to decide which version to use that you can read here however I commonly ask the following questions in helping schools decide which version to use:
Are you only going to be managing Windows10 Devices?
Yes? Use Intune for Education
No? Use full Intune for multi-OS management
Will teachers and other less technical people be wanting to manage settings and push applications?
Yes? Use Intune for Education if possible (see above re: Win10) as the interface is simplified and very easy for non-technical people to use.
No? Use either, if you’re more comfortable with a large amount of settings and configuration options then the full version of Intune will be more valuable.
Do you have advanced configuration settings and policies you want to configure on the devices you’re managing (i.e. replicating Group Policy).
Yes? Use the full version of Intune standalone as this has significantly more settings and options
No? Use Intune for Education if dealing only with Windows 10.
It is worth pointing out that since Intune for Education was first released, new features have been added to it, including the ability to manage iPads in late 2018 – really helpful for schools that are wanting to develop a “single pane of glass” for configuring and deploying all their educational devices.
What Are CSP?
CSP stands for Configuration Service Providers and the best place to get started if you have no knowledge of this is here – CSP For Beginners.
A CSP is an interface in the client operating system between configuration settings specified in a provisioning document and configuration settings on the device. Their function is similar to that of Group Policy client-side extensions in that they provide an interface to read, set, modify, or delete configuration settings for a given feature. Typically, these settings map to registry keys, files or permissions. Some of these settings are configurable and some are read-only.
The reference to Group Policy client-side extensions above is important and useful because most IT Admins are familiar with these, and when you explain that CSP achieve the same outcome but are managed out of the cloud from an MDM like Intune, they generally get the concept quite quickly.
In essence, a CSP allows you to restrict/allow various functionality on an end device – in this case we will primarily be talking about Windows 10 – such as allowing the Edge web browser to make search recommendations. Some of these settings are enabled via the GUI inside of Intune, others need to be manually created with a Custom CSP Policy (read on below for an example). To return to the Edge search setting example, in Intune the policy to allow search suggestions in the Microsoft Edge address bar uses Browser/AllowSearchSuggestionsinAddressBar in the Policy CSP
The GUI inside of Intune on the left simply configures the CSP on the right to either 0 (not allowed) or 1 (allowed)
Once you understand the concept of what you can do with CSP and are ready to get your training wheels off, reading the full list of Policy CSP available here is a great starting point. In fact, because not all CSP are currently available in Intune’s GUI, you may find some advanced features that can only be deployed using the Custom CSP Policy (again, read on for a good example of this).
It’s worth noting that the full version of Intune has many capabilities to manage iOS devices, often requiring a custom Profile to be created and pushed to the iPad. I’ve written a five part blog series showing how you can do this on iPads that is worth reading here.
Building A Custom CSP Policy
I got tipped off by a friend who is far more technical than me to two CSP that exist in the Authentication section and are designed to speed up the initial login of Windows 10 devices in a shared environment like a school:
This policy is intended for use on Shared PCs to enable a quick first sign-in experience for a user. It works by automatically connecting new non-admin Azure Active Directory (Azure AD) accounts to the pre-configured candidate local accounts.
Specifies the preferred domain among available domains in the Azure AD tenant.
Example: If your organization is using the “@contoso.com” tenant domain name, the policy value should be “contoso.com”. For the user “abby@constoso.com”, she would then be able to sign in using “abby” in the username field instead of “abby@contoso.com”.
Both of these require Windows10 Pro or above to work.
Both Intune and Intune for Education are rapidly adding new features into the GUI and, as indicated in Brad Anderson’s blog post above, Intune for Education recently added the Preferred AzureAD Tenant Domain Name feature to the GUI:
Available in the Settings Blade, an IT admin can rapidly add this setting to Win10 devices now.
However, if you’re wanting to build a Custom CSP Policy for a setting that is not in the GUI yet, such as enabling Fast First Sign In, then the steps would be as follows:
Note in the main display you can see existing Profiles I’ve created already, including my example “Fast Signin and UPN Default”
The “Name” and “Description” Fields are entirely up to you, however make sure you choose “Windows 10 and later” for the Platform and, critically, you choose “Custom” for the “Profile Type”. On the left below is my configured policy, on the right is the options when creating a new one
Once you have a Profile created, you need to add settings to it so click “Add” – this is where you need the documentation to guide you for the correct CSP e.g. for Authentication CSP
Again, the “Name” and “Description” fields are largely up to you, but the critical fields are the “OMA-URI” and “Data Type” and “Value” fields are all going to be informed from the CSP documentation
Here are my completed examples:
In this example the Data Type is a string, as I’m putting in my O365 tenant’s domain name. The full OMA-URI in this example is: ./Vendor/MSFT/Policy/Config/Authentication/PreferredAadTenantDomainNameIn this example the Data Type is an Integer with “1” = on and “0” = off. The full OMA-URI in this example is: ./Vendor/MSFT/Policy/Config/Authentication/EnableFastFirstSignIn
With your custom CSP Policy created, you now need to assign this to devices under the “Assignments” Setting – in my example I’m applying it to All Devices:
At this point, you’re pretty much done and you can sync devices to ensure the policy is pushed to them. Reporting inside of Intune will advise you whether this has been successfully deployed to devices:
In my experience, applying the two policy settings for shared devices in education significantly improves the initial sign in experience in two ways:
Fast First Sign In – does exactly what it’s name suggests, reducing the time considerably for a student to sign into a Windows 10 device for the first time
Preferred AzureAD Tenant Domain Name – given many younger students are not great at typing, or remembering relatively complicated text like a school domain name, allowing them to simply type their username e.g. “sam.mcneill” or even “samm” (based on school username policy) reduces the complexity of the sign in process.
As you can see, you have very high levels of control over devices when you’re using CSP, either through the GUI in Intune itself, or via building custom CSP policies as I did above. If you want even more control, you can even explore using ADMX Templates inside of Intune.
Using LOB App Deployment in Intune
The last feature I’m going to show in here is a trick I learnt from David Kozera to speed up the access to shared applications for users when they first sign in.
Intune for Education initially allowed only apps inside of the Microsoft Store for Education to be deployed to devices, which was great if you were running Windows 10S, but less helpful if you had a need to install apps that were not inside the store. They did eventually add the ability to install .msi packages, and inside of the full version of Intune you can actually install quite a range of different application types, including the recent addition of Win32 apps.
Why is this important? Well, many schools I speak to want to use Intune to push out Minecraft: Education Edition to their student devices, and simply select the app in the MS Store for Education and deploy it using either version of Intune. This works flawlessly, but one of the downsides on a shared computer is that apps deployed from the Store deploy to the user rather than to the device. What this means in practice is when a user signs in for the first time to a shared device they do need to wait a few minutes for apps from the Store to appear on their device.
Using Intune to push Minecraft:EE as an LOB app, rather than a Store app, makes it instantly available to a student when they log into a shared device for the very first time. This means no waiting for apps to appear and no lost teaching time.
Go to the Education Store and find Minecraft:EE under the “Products and Services” that are managed, then select to “Download for offline usage” – this will effectively allow you to download a .appx file:
Scroll down a little further and download the “Required Frameworks” file as well, as you’re going to need this in Intune shortly:
With the two files downloaded, you need to return to Intune and click on “Client Apps” and then “Apps”
You need to click “Add” to start building a new app – see below in my screenshot you can observe the different types of apps that I have available to deploy, and I’ve circled the Minecraft:EE Universal App (.appx) as a Line of Business app, as well as Chrome Browser as a .msi Line of Business App, compared to the standard Microsoft Store apps.
Make sure you choose a Line of Business App:
Upload the .aopx version of Minecraft and the dependency framework file you downloaded:
Configure the app information as it will appear to your users once installed on their device:
With this done, you can now assign the app for deployment based on your groups of devices – it will automatically install the first time and be instantly available for any user as soon as they sign into the device the first time.
Final Thoughts
Cloud Identity and Cloud MDM’s make the management of devices easier than ever. For schools, who often have limited funds and resources to manage devices, exploring AutoPilot and Intune for Education makes a lot of sense to simplify the management and deployment of devices, as well as reducing the need for on-premise servers for device provisioning.
As these services become even smarter, remote resets of devices and troubleshooting become easier as well. For many, however, their view of managing Windows is from many years ago and they simply do not have experience with Windows 10 and modern practices around deployment.
IF you’re interested in knowing more, reach out to me on Twitter or if you have your own tips for improving deployment in this way, drop a message in the comments below.
Last week my 13 year old daughter came home with a big grin on her face telling me how she was able to use her new Surface Pro and Surface Pen to draw up her science experiment at school. I asked her to show me and you can see the screenshot above with her diagram of the experiment.
I’ve added a couple of markings in red ink on my Surface Laptop with some additional call outs:
Even though the teacher had created this traditional “worksheet” using Microsoft Word, my daughter was saving this inside of her OneDrive with Word in Office365. This meant it was automatically saving to the cloud with “Auto Save” (top left)
In the top centre of the screen you can see her Word showing the most recent version of the document – at any stage, she could have shown previous versions – again, powered by OneDrive and cloud saving with Office365
The top right shows the cloud-powered Dictate in Office365 – this made possible (and smarter) by using Intelligent Services from Microsoft:
Dictate is one of the Office Intelligent Services, bringing the power of the cloud to Office apps to help save you time and produce better results.
Perhaps the pièce de résistance is the actual Digital Inking she was able to do directly inside of Microsoft Word when she drew up the experiment. She described how some of the classmates on other platforms were attempting to draw this with their mouse and finding it pretty difficult! Of course, there is plenty of research highlighting the value of Digital Inking when it comes to improved critical thinking and test scores – Miss 13yrs was not thinking of this at all (naturally) but simply reveling in the ease of completing her science report digitally!
Personally, I would probably not use Word for something like this (Class Notebooks in OneNote are more my style), but this is a great example from a real high school science classroom showing the versatility of Microsoft Word with Office365, Cloud Services in OneDrive, and Digital Inking on a Surface Pro.
In my job I chat a lot with both school leaders and IT admins about how they can simplify the management of their devices, making it faster and easier for their end users (usually students, teachers and admin staff) to get started and complete the work they need to do on a device.
Unlike many corporate environments, schools have a very high number of “shared devices” in operation, where students of different year levels require access on the same device and, in some scenarios, even teachers need to log into the same device and access different apps and security settings. In the next two blog posts I’m going to go a bit deeper into how schools can approach this challenge with modern deployment practices, leveraging cloud identity in AzureAD, easier enrollment of devices using Microsoft Autopilot and finally a couple of tweaks for a faster user sign-in experience using Microsoft Intune as the Mobile Device Management (MDM) tool.
Overview:
As this blog post will be a little longer (and more technical) I’m going to give you a break down of what is to come so you can skip to the important sections relevant to you:
Now it’s worth stating at this stage that I am not an IT administrator by profession. Whilst I’m probably more technical than many, I’ve got the following working through a combination of relying on the detailed guides in the Microsoft Docs and awesome technical colleagues who have shared some of their expertise with me. Additionally, like you, I read a bunch of blogs to see how people have done this in the past. This blog is a small contribution to the community who like to learn from other’s experiences. If you’re reading this and are more technical than me and see some improvements or corrections in what I’ve done – I’d love to hear from you in the comments section below.
With that said, let’s get started!
Identity – why use a cloud identity?
It’s amazing how many conversations I’ve been having around cloud identities recently as school leaders are starting to understand they need to be able to simplify user access to key resources via Single Sign On (SSO), and open up both cloud/internet solutions as well as traditional on-premise hosted solutions. There are plenty of confusing diagrams out there trying to explain what this is about – the following is the simplest I could find:
Essentially, the above is showing two scenarios:
The user may sign into an “on-premise” identity platform (on the left), in this case Active Directory (still incredibly common in schools) which, through the use of a tool called AzureAD Connect can automatically sign into a cloud identity as well, in this case Azure Active Directory (AzureAD or even AAD).
Alternatively, the user may sign directly into a cloud service (on the right) using their AzureAD credentials. In fact, if their device is managed by the school, it may even be joined to AzureAD only.
Why does this matter? As an example, I was talking with a school recently where teachers were required to use up to four different usernames/passwords to access their key platforms such as signing into a computer, accessing their email, accessing their Student Management System (SMS) and accessing their cloud collaboration suite (Office365 in this case). Simplifying this through a single cloud identity saves time and frustration for everyone! It also improves security as people are more likely to choose a secure password if they only have one to remember.
The key point is: identity matters. If your school does not have a cloud identity of some sort, you’re going to be inherently limited in what you can do.
As the focus of this blog is primarily around AutoPilot, I’m not going to go deep into Identity – some useful background reading I would share is earlier blog posts I’ve written around:
If your users only exist inside the Google Suite and you’re wanting to leverage Office365 / Minecraft:EE then completing a simpler “Similiar Sign On” may be worth exploring – the blog post for this is here.
For the purposes of this blog, if you’re wanting to use AutoPilot then your Office365 Tenant must have either the AzureAD P1 or P2 plans – see the differences here. With many schools opting for the M365 A3 Suite, this includes AzureAD P1:
Azure Active Directory Premium P1. In addition to the Free and Basic features, P1 also lets your hybrid users access both on-premises and cloud resources. It also supports advanced administration, such as dynamic groups, self-service group management, Microsoft Identity Manager (an on-premises identity and access management suite) and cloud write-back capabilities, which allow self-service password reset for your on-premises users.
To proceed with AutoPilot you need your users in AzureAD (and licensed with P1 or P2) so if you’ve not got that far, best to stop and sort before continuing on (if you want help with this, check out School Data Sync which can automatically add users from your Student Information System).
Why use AutoPilot?
It’s always a good question to ask, and before answering if you’re brand new to AutoPilot then it’s worth watching the video at the top of this blog post and then getting into the official AutoPilot Documentation here. If you’re coming from an Apple device management world and are familiar with the Device Enrollment Program (DEP) then the concepts of AutoPilot will be very familiar for you.
Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, re-purpose and recover devices.
This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that’s easy and simple.
Windows Autopilot is designed to simplify all parts of the life cycle of Windows devices, for both IT and end users, from initial deployment through the eventual end of life. Leveraging cloud-based services, it can reduce the overall costs for deploying, managing, and retiring devices by reducing the amount of time that IT needs to spend on these processes and the amount of infrastructure that they need to maintain, while ensuring ease of use for all types of end users.
Back to the why use it…..
Devices become enrolled / locked to your organisation. If a user (authorised or not) resets the Win10 OS back to factory settings, as soon as it connects to the internet again it will register back to your organisation, making it largely useless to anyone if it was stolen.
Speeds up and simplifies the Win10 setup process – you can optionally skip quite a few of the steps you normally need to undertake in Win10 e.g. requiring the user to agree to the EULA, choosing their privacy settings, configure whether the user will be an Administrator or a Standard user, and depending on deployment mode, can even skip keyboard preferences.
Devices can be assigned to specific users, meaning when they turn it on for the first time, connect to the internet they’re greeted by name as part of their organisation.
AutoPilot Reset allows an IT Admin to remotely reset the device, returning it to the original state, but keeping it joined to AzureAD and enrolled into Intune for management – think of this like a “spring clean” at the beginning of the school year or new Term.
In short, AutoPilot is designed to make your life easier!
Configuring Autopilot
For my demo and testing, I’m using an Acer B117 laptop, something that is available in the NZ Education Right Device Campaign, a low cost, low spec Win10 device with 4GB RAM and options around 64/128GB SSD storage. One of the beauties of AutoPilot is that supported OEM devices can send the unique Hardware Identifier (HWID) to the purchasing organisation / school in advance of receiving the devices, allowing for the configuration of the entire environment in advance of even receiving the hardware.
An obvious upside for this would be the ability to ‘drop ship’ devices to remote employees directly from purchase, without the need for IT Admins to even site the device.
In my case, I needed to manually extract the HWID from the Acer laptop, which can easily be accomplished with some basic PowerShell (run as local Administrator):
Basic PowerShell commands will allow you to extract the unique Hardware Identifier (HWID) for your existing device – this is required for AutoPilot to run
With the HWID obtained, the process to complete the configuration of AutoPilot is easily followed by these step by step instructions here, but largely consist of the following steps:
Add your devices (HWID) into Intune
Create an AutoPilot Device Group (tells Intune which devices in your organisation should be managed by AutoPilot). Note you can do both static and dynamic rules for adding devices here.
Create an AutoPilot Deployment Profile – this is the configuration settings you want to choose and allows you to skip a number of the standard Win10 decisions that need to be made when a device is being set up for the first time.
Assign an AutoPilot Deployment Profile to a Device Group – this matches what you’ve created in Step 2 with Step 3
Assign a user to a specific AutoPilot Device – this optional step allows you to match a user in your organisation with a specific device. The net result of this is the first time the user turns on the computer and connects it to the internet their name and email address is pre-populated in the setup process, meaning they only need to confirm their password during the setup – very cool!
The documentation I’ve linked to is pretty clear – it took me about thirty minutes to follow along and set the above up the first time I ran it.
Enrolling Your Device
Now the fun really beings. With the configuration completed, you can take your brand new ‘out of the box’ device and enroll it using AutoPilot for a truly streamlined, managed experience.
I took some photos of the experience using my phone camera (photo quality is average) and anyone that has ever set up Windows 10 will be familiar with this process:
A user must always choose their regionKeyboard preference remains a requirement
At this point, once the device is connected to the internet it will automatically join AzureAD and enroll into Intune because the HWID is registered with your tenant. Further Win10 setup steps can be optionally skipped at this point based on the Autopilot Profile configuration.The device immediately starts to configure based on AutoPilot Deployment Profile you’ve created and assigned to the Device GroupThis screenshot shows AutoPilot busily configuring the device and giving progress updates – the time this takes varies based on how many apps you’ve chosen to push to the device.Done! Note the following: 1) School logo is displayed 2) User is greeted by name if the device is specifically assigned to a user 3) The school/organisation name is displayed; 4) The user’s email address is displayed 5) A customisable welcome message is displayed with contact details for assistance.
At this point, the device settings and applications are installed (or possibly still coming down over the internet) but the device is ready for us.
The end user had minimal choices and actions required of them:
Choose their country
Choose their keyboard
Connect to the internet (this could even be their home WiFi)
Enter their organisation password (Office365)
My Thoughts
Modern deployment relies on the cloud for identity and provisioning of devices – there are no on-premise servers in the above model. This allows for fast, flexible and lower cost management of devices – something that appeals to education institutes where every dollar counts!
Whilst I’ve gone through the configuration pretty quickly above, along with a high level ‘rationale’ of why you’d want to do this, the next post will go a bit deeper into when to use Intune vs Intune for Education, and a couple of tweaks to make your devices run even faster at sign in and have key applications appear instantly whenever a new user signs in. I’ll likely post this in the next week or so.
