Santa brings you Autopilot (and more)

Christmas is coming soon! And fitting for the occasion, I wrote the PowerShell module “IntuneStarterKit”, which I gave to Santa for the “Festive Tech Calendar 2022”. With the module you can very quickly put together a base configuration with Autopilot, a few apps as well as Windows and security configuration. This way you start managing Windows devices with Intune without much effort and clicking, or in other words, you have the deployment automated.

IntuneStartKit @GitHub

IntuneStartKit @PSGallery

Quick overview

The main function of the module is called “Add-ISK” and calls all the other functions to provide you with the following:

• Dynamic group that contains all Autopilot registered devices
• Standard group for apps and configurations
  • The dynamic Autopilot group is a member of this one
• Autopilot profile named “Default ISK Profile”
• Enrollment Status Page (ESP) named “Autopilot ESP”
• Base Intune configuration from my GitHub
  • IntuneStarterKit/Samples/Configuration at main · FlorianSLZ/IntuneStarterKit (github.com)
• Base applications from my GitHub
  • IntuneStarterKit/Samples/Apps at main · FlorianSLZ/IntuneStarterKit (github.com)
  • One installation group per app, in which the standard group is a member

Install the module

To get started, first you need to install the module on your machine, which you can do either system-wide or just in your user context.

# Installation on local machine (as Admin)
Install-Module -Name IntuneStarterKit

# Installation in user context (no Admin needed)
Install-Module -Scope CurrentUser -Name IntuneStarterKit

If you run into problems during installation, authentication or module conflicts, I recommend testing the module in a Windows Sandbox. That way you make sure no old module version or anything else on your PC gets in the way.

Create your Intune environment with the IntuneStarterKit

After installing the module, you can deploy the whole environment quite easily. Basically even with just the command “Add-ISK”. But there are a few more parameters you can add. For example the -Language parameter, since otherwise the language will be set to “de-CH”.
A few examples follow further below.

And with that, you have your Intune deployment automated. (At least with my template.)
Here’s also the whole process in a GIF:

And here the promised examples for your own groups and languages, but there’s more to come. You can also import configurations and apps as you like.

# Deploy with an English Autopilot profile (en-us)
Add-ISK -Language "en-us"

# Deploy with different default groups
Add-ISK -APGroupName "WIN-Devices_Autopilot" -StdGroupName "WIN-StandardConfiguration"

# Deploy without a group per app installation
Add-ISK -AppGroup:$false

Use your own configuration

To use your own configuration template, you can put together the configuration the way you like it in Intune and export it with the module “IntuneBackupAndRestore”.

For the export, you just need to run the backup command with the path specified:
Start-IntuneBackup -Path "C:\temp\IntuneBackup”

Afterwards you have your own configuration files together and can import them.
(The variable $GroupID is the ID of the group the configurations get assigned to.)
Add-ISKConfiguration -AssignTo $GroupID -Path "C:\temp\IntuneBackup”

You can also store the configuration in a GitHub repository (currently only public) and then specify the URL to it as the path:
Add-ISKConfiguration -AssignTo $GroupID -Path "https://github.com/FlorianSLZ/.../Configuration"

Use your own apps

Just like with the configuration, you can also specify your own apps. To do this, you build yourself a repository in the correct format. You pack every Win32 app into its own folder named after the app, in which the install.win is also located, named after the app. In addition, you place a validation script named “check.ps1” in there.
If you have never created a Win32 app before, you’ll find some help and templates on my blog in the category “Win32”: Win32 | scloud

The programs/folders need to be structured like this:

File	Purpose
install.ps1	Installation routine
uninstall.ps1	Uninstallation routine
check.ps1	Validation script
AppName.intunewin	Intunewin file of the app

And here’s what the repository looks like visualized:

The command to import and assign these apps is:

# Add and assign App to Group with ID
Add-ISKApps -AssignTo $GroupID -Path "C:\temp\Repository"

# Add and assign App to individual grou per App and add Group with ID as member
Add-ISKApps -AssignTo $GroupID -AppGroup -Path "C:\temp\Repository"

# only add apps (without assigning)
Add-ISKApps -Path "C:\temp\Repository"

Create your own deployment

Once you have your own apps and configurations together, you have all the prerequisites to write yourself an own deployment script as well.
Here two examples of how this could look:

# Option 1: Custom Language, Apps, Config and Group names
Add-ISK `
-APGroupName "My-AP-Group" `
-StdGroupName "My-Default-Group" `
-Language "de-CH" `
-AppGroupPrefix "My-App-" `
-AppRepoPath "C:\ISK\Apps" `
-ConfigRepoPath "C:\ISK\Configuration"

# Option 2: Only Autopilot Profile, Apps and Configuration with custom dynamic "marketing" Group
## create dynamic group based on group tag "Marketing"
$APGroupTag = New-MgGroup -DisplayName "DEV-WIN-Marketing" `
-Description "Autopilot group tag: Marketing" `
-MailEnabled:$false `
-SecurityEnabled:$true `
-MailNickname "DEV-WIN-Marketing" `
-GroupTypes "DynamicMembership" `
-MembershipRule '(device.devicePhysicalIds -any (_ -eq "[OrderID]:Marketing"))' `
-MembershipRuleProcessingState "On"
## create Autopilot profile for Marketing
Add-ISKAPProfile -Name "Marketing" -AssignTo $APGroupTag.id -Language "en-UK"
## Import configuration and assign to Marketing group
Add-ISKConfiguration -Path "C:\ISK\Configuration" -AssignTo $APGroupTag.id
## Import Apps for marketing and assign them
Add-ISKApps -Path "C:\ISK\Apps" -AssignTo $APGroupTag.id

Credits #CommunityRocks

Of course I did not build all these functions from scratch myself. Many parts were already worked out by other community members or were needed in a similar form.
The following sources helped me a great deal:

• microsoftgraph/powershell-intune-samples: This repository of PowerShell sample scripts show how to access Intune service resources. They demonstrate this by making HTTPS RESTful API requests to the Microsoft Graph API from PowerShell. (github.com) - Microsoft now marks this repository read-only/deprecated; the current replacement is microsoft/mggraph-intune-samples, built on the Microsoft Graph PowerShell SDK.
• MSEndpointMgr/IntuneWin32App: Provides a set of functions to manage all aspects of Win32 apps in Microsoft Endpoint Manager (Intune). (github.com)
• jseerden/IntuneBackupAndRestore: PowerShell Module that queries Microsoft Graph, and allows for cross-tenant Backup & Restore actions of your Intune Configuration. (github.com)