Entra ID / Autopilot enrolment

CloudImage can register each device into Windows Autopilot during deployment, so it automatically joins Entra ID and enrols in Intune on first boot. To do this on your behalf it uses Microsoft Graph, which requires a one-time app registration in your Entra ID (Azure AD) tenant.

Create the Entra ID app registration

Do this once per Entra tenant, in the Microsoft Entra admin portal (entra.microsoft.com) or the Azure portal. You'll need Global Administrator (or Application + Privileged Role Administrator) rights.

1. Entra ID → App registrations → New registration.
2. Name: e.g. CloudImage Autopilot.
   Supported account types: Accounts in this organizational directory only (single tenant).
   Redirect URI: leave blank - this is an app-only integration with no interactive sign-in. Click Register.
3. On the app's Overview page, copy these two values:
   • Directory (tenant) ID
   • Application (client) ID
4. API permissions → Add a permission → Microsoft Graph → Application permissions. Search for and add:
   • DeviceManagementServiceConfig.ReadWrite.All
   This is an Application permission, not Delegated - the integration signs in as the app, not as a user.
5. Click Grant admin consent for <your organisation> and confirm. The permission must show a green "Granted" status. Without admin consent, device registration fails.
6. Certificates & secrets → Client secrets → New client secret. Give it a description and an expiry (e.g. 24 months), then Add. Copy the secret Value immediately - it's shown only once and cannot be retrieved later.

Enter the details in CloudImage

In CloudImage, go to My Organisation → Overview → Microsoft Intune Integration.

my-organisation / intune-integration

1. Paste in:
   • Entra Tenant ID ← Directory (tenant) ID
   • App Registration Client ID ← Application (client) ID
   • Client Secret ← the secret Value (stored encrypted)
   • (Optional) Secret expires - set the same expiry you gave the secret, so CloudImage can remind you before it lapses.
2. Save, then use Test Connection to verify - it authenticates and reads your Autopilot device collection to confirm the permission and consent are correct.
3. Add the Entra ID Join + Intune step to a Task Sequence to enable enrolment on deployments.

Notes & maintenance

• Client secrets expire. Set a reminder to create a new secret before the expiry date and update it in CloudImage, or Autopilot registration will start failing once it lapses.
• Least privilege: DeviceManagementServiceConfig.ReadWrite.All is all that's needed for Autopilot device registration.
• Troubleshooting: "Permission denied - the app needs the DeviceManagementServiceConfig.ReadWrite.All Graph permission with admin consent granted" means the permission or consent step wasn't completed.

Device naming note

With Autopilot, the device name applied at OOBE is controlled by your Autopilot deployment profile's naming template in Intune. If you need each device to keep the exact name typed during deployment, ensure your profile is configured accordingly.

Autopilot group tags - choose per device

A group tag is a label stamped on a device's Autopilot record. In Intune you point an Autopilot deployment profile at a dynamic device group that matches a tag - so tagging a device Student gets it the student profile, Admin gets the admin profile, and so on.

CloudImage lets you set up a list of tags per organisation and have the operator pick one per device during deployment - so a single task sequence covers every role instead of needing one near-identical sequence per tag. Optionally, a name prefix pre-selects the right tag from the computer name (ADM-PC01 → Admin), the way many teams did this in SCCM. Optional - until you add tags, deployments behave exactly as before.

Set up your tag list

• Customer administrators: My Organisation → Overview → Autopilot Group Tags.
• MSP / platform staff: Settings → Intune → Autopilot Group Tags - a tag list can be kept private to one customer or shared across all your customers.

Click Add group tag and fill in:

A typical school setup:

Name prefix is entirely optional. Leave it blank and the operator simply picks from the list every time - nothing is pre-selected.

What the operator sees

Once at least one tag exists, the deployment wizard gains an Autopilot Group Tag step, between the computer name and the confirmation:

1. Choose Task Sequence
2. Computer Name        →  operator types ADM-PC01
3. Autopilot Group Tag  →  "Admin Staff" already highlighted,
                           because ADM-PC01 matched the ADM- prefix
4. Confirm              →  "Group tag: Admin"

• The operator always sees the list and can pick any tag - a name prefix only decides which row starts highlighted, it never forces the choice. The tag is shown on the confirmation screen before the disk is wiped.
• The list always includes Use task sequence default (showing the actual value), which applies whatever tag the task sequence's Entra ID Join + Intune step is set to.
• Which tag wins: the operator's choice if they picked one; otherwise the task sequence step's tag. Existing task sequences keep working unchanged.
• Check what was applied on the deployment's detail page - it shows the tag used and whether the operator chose it or a name prefix did, so a device landing on the wrong Autopilot profile is diagnosable without opening Intune.

Targeting an Autopilot profile at a tag

In Intune, create a dynamic device group with a membership rule matching the tag, then assign your Autopilot deployment profile to that group:

(device.devicePhysicalIds -any (_ -eq "[OrderID]:Admin"))

Replace Admin with your tag value. (OrderID is Entra's internal name for the group tag - that's expected.)

• The match is exact - Admin and admin are different tags. Setting tags up as a list means the operator can't mistype one.
• Name prefix is a prefix, not a pattern - enter ADM-, not ADM*. Matching ignores case; where two prefixes match, the longer one wins.
• No match is safe - if the computer name matches no prefix, the picker opens with Use task sequence default selected. It never guesses.
• Changing a tag affects future deployments; devices already registered keep their tag - change those in Intune.