-
Methods to reset an autopilot device
There are a few different ways to remotely reset a Windows 10/11 device from Intune: wipe, fresh start, reset.
The following table summarises the behaviours of each method.
Method Usage OOBE User data Intune management Azure AD enrollment Retire/Delete Get rid of outdated devices Yes Keep remove remove Wipe (keep enrollment) Reset device to default. Remove Apps No Keep keep keep Wipe Reset OS to default.
Good for lost stolen device and device handoverYes Remove remove remove Fresh Start (keep user data) Reset device to Signature Edition, remove Apps.
Update to latest Windows versionNo Keep keep keep Fresh Start Reset device to latest Windows Signature Edition.
Update to latest Windows versionYes Remove remove keep Autopilot Reset Reuse a device.
Does not support Hybrid Azure AD joined devicesNo Remove keep keep -
Different Azure AD Join Types
It can take some research and tests to understand the difference between different Azure AD join types.
I summarised some key differences in the following.
Difference between Azure AD registered Azure AD joined Hybrid Azure AD joined Primary audience Bring your own device (BYOD) Mobile devices Organizational computer Organizational computer OS Windows 10, iOS, Android, and MacOS Windows 10 devices (except Windows 10 Home) Windows Server 2019 Virtual Machines running in Azure (except Server core) Windows 10, 8.1 and 7 Windows Server 2008/R2, 2012/R2, 2016 and 2019 Device sign in options Local account Windows Hello Organizational account in Azure AD Windows Hello for Business Organizational account in on-prem AD Windows Hello for Business Sign in authenticate to Local computer Azure AD On-prem domain controller Device management MDM (Intune) MDM (Intune) MDM (Intune) and Group policy SSO SSO to cloud resources SSO to both cloud and on-premises resources SSO to both cloud and on-premises resources Self-service Password Reset Only for local account For Organizational account at login/lock screen For Organizational account at login/lock screen As more and more staff work from home, IT starts to consider solutions to allow remote identity management without relying on line-of-sight to domain controllers. so:
- If you want to login to a computer by authenticating to Azure AD, you will need to unbind the computer from on-prem AD then bind to Azure AD. A hybrid Azure AD joined computer will still authenticate to your domain controller
- Microsoft recommends to use the MDM-only approach to manage all Azure AD joined devices, instead of co-management with SCCM.
-
-
