Entra ID / Autopilot enrolment

CloudImage can register each device into Windows Autopilot during deployment, so it automatically joins Entra ID and enrols in Intune on first boot. To do this on your behalf it uses Microsoft Graph, which requires a one-time app registration in your Entra ID (Azure AD) tenant.

Create the Entra ID app registration

Do this once per Entra tenant, in the Microsoft Entra admin portal (entra.microsoft.com) or the Azure portal. You'll need Global Administrator (or Application + Privileged Role Administrator) rights.

1. Entra ID → App registrations → New registration.
2. Name: e.g. CloudImage Autopilot.
   Supported account types: Accounts in this organizational directory only (single tenant).
   Redirect URI: leave blank - this is an app-only integration with no interactive sign-in. Click Register.
3. On the app's Overview page, copy these two values:
   • Directory (tenant) ID
   • Application (client) ID
4. API permissions → Add a permission → Microsoft Graph → Application permissions. Search for and add:
   • DeviceManagementServiceConfig.ReadWrite.All
   This is an Application permission, not Delegated - the integration signs in as the app, not as a user.
5. Click Grant admin consent for <your organisation> and confirm. The permission must show a green "Granted" status. Without admin consent, device registration fails.
6. Certificates & secrets → Client secrets → New client secret. Give it a description and an expiry (e.g. 24 months), then Add. Copy the secret Value immediately - it's shown only once and cannot be retrieved later.

Enter the details in CloudImage

In CloudImage, go to My Organisation → Overview → Microsoft Intune Integration.

my-organisation / intune-integration

1. Paste in:
   • Entra Tenant ID ← Directory (tenant) ID
   • App Registration Client ID ← Application (client) ID
   • Client Secret ← the secret Value (stored encrypted)
   • (Optional) Secret expires - set the same expiry you gave the secret, so CloudImage can remind you before it lapses.
2. Save, then use Test Connection to verify - it authenticates and reads your Autopilot device collection to confirm the permission and consent are correct.
3. Add the Entra ID Join + Intune step to a Task Sequence to enable enrolment on deployments.

Notes & maintenance

• Client secrets expire. Set a reminder to create a new secret before the expiry date and update it in CloudImage, or Autopilot registration will start failing once it lapses.
• Least privilege: DeviceManagementServiceConfig.ReadWrite.All is all that's needed for Autopilot device registration.
• Troubleshooting: "Permission denied - the app needs the DeviceManagementServiceConfig.ReadWrite.All Graph permission with admin consent granted" means the permission or consent step wasn't completed.

Device naming note

With Autopilot, the device name applied at OOBE is controlled by your Autopilot deployment profile's naming template in Intune. If you need each device to keep the exact name typed during deployment, ensure your profile is configured accordingly.