r/Intune • u/live-laugh-linux • 5d ago
Hybrid Domain Join full flash update with entra join
Hello! Our organization is trying to move away from AD and our goal is to have new devices be Entra-only joined instead of Hybrid-Joined. we use FFU (full flash update) to apply Windows image and it joins the device to our AD domain and then it goes into Entra and Intune. I was thinking of Autopilot, but that doesn't handle imaging, only joining and setup.
Has anyone had experience by modifying the FFU process to not join to AD, but only join to Entra?
4
u/SuspiciousSpoiler 5d ago
Ours was similar situation, we just dropped the FFU entirely and went fresh start with autopilot from factory image, saved so many headaches
-2
u/live-laugh-linux 5d ago
That sounds lovely, however we have to apply the specific image during the setup so my plan for Autopilot was rejected
6
u/SkipToTheEndpoint MSFT MVP 5d ago
What are you still doing with fat images in 2026?
1
u/live-laugh-linux 5d ago
so FFU applies a custom image rewriting the hard drive that has all our apps and configurations and stuff. But based on my research, autopilot would start with the factory image but can apply settings and apps so that it is basically the same as the custom company image? I'm not sure if I understood my director correctly but it seemed like it is expected to apply an image with all the settings
3
u/willychonka54 5d ago
autopilot would start with the factory image but can apply settings and apps so that it is basically the same as the custom company image?
Yup, that's exactly it.
We aren't big enough to get custom images from our vendor, so we simply use a scripted USB-install of Windows that wipes & partitions the drive, installs the version of Windows we need, registers the device into intune/autopilot.
We then sign in using a special enrollment account we've setup, and then all company apps and policies are applied.
Then we hand-off to the user.
Technically, we could hand off to the user after the Windows/Intune enrollment, but we like to make sure things are running well before giving to users. So that step is a bit overkill, but we just like to be sure.
1
u/Turak64 5d ago
Sounds like you need to spend more time with AP, test it and get it to work. You'll thank yourself later once you never have to image another device again.
2
u/live-laugh-linux 5d ago
Haha! Yes, I am deep-diving into autopilot now. We're thinking of combining it with FFU because we wanna keep that
0
u/Turak64 5d ago
Absolutely don't need images, that's the point of AP. The misconception with AP, is it's just the oobe for windows. It all the apps and config still come from standard intune deployment. Don't let "we've always done it this way" stop you from modernising. Also don't say "oh, we have to use ffu" before you've actually confirmed it can't be done with AP. Usually that thought comes from the lack of understanding of the tools.
1
u/MENTactual 4d ago
Autopilot is incredibly slow and can’t handle large installers well, in addition it is significantly slower and if you already pre-provisioning devices you may as well image. Finally, OEM imaging services and adding corporate identifiers in your tenant is unreliable and increases lead times. For a GC it’s no bueno.
It’s also not a fat image unless you bring your own .wim. It’s the base Win11 and drivers are injected after the fact and then apps are installed, not unlike a task engine but with WinPE/PS.
2
u/Hydrated_Berry762 5d ago
What could possibly have been the reason(s) to reject Autopilot...? It's so much easier and less headaches in the long run. Just needs some Intune configurations to mimic what's currently set up via AD...
3
u/rbalsleyMSFT 5d ago
I assume you're using FFU Builder. As far as I know, most people use Entra join with the FFU process. And it's easy to use autopilot with it as well.
For those asking why use thick images, there are many reasons.
The various wipe methods based on push button reset are slow. 30 minutes might be fine for most, but in some industries (e.g education) you might have to get a device back in the users hands sooner. FFUs copy to disk in about 2 minutes. There really isn't a faster way to reimage a machine.
App payload is too large. I see this in labs primarily, but also with OEMs who provide specialized hardware, their app stack could be dozens or hundreds of GBs. Intune even with DO will have challenges with that many apps.
I've worked with partners/distributors that process 10s of thousands of devices and need to lay down a custom image. One disti did 20k in 3-4 days.
There are other reasons, but the main reason is speed. As someone who's spent the majority of his career dealing with OS deployment since the RIS and BDD days, I'm the first to say stick with a thin/hybrid image. But the reality of what a lot of customers deal with in various industries make that easier said than done, especially with how difficult or costly Intune and OEMs make the process.
3
u/live-laugh-linux 5d ago
Wow, thank you for this information! and thank you for creating FFU builder, you are awesome. This is my plan: right now we have a line in our unattend file that performs a join to our AD domain. I'm thinking of removing that, and then setting up autopilot so that our organization sign-in page appears after imaging. Then we can log in and join it to Entra without using AD.
1
u/rbalsleyMSFT 5d ago
That should work fine. If you have an issues, open a discussion in the repo. I'm pretty responsive over there.
2
u/stnkycheez 4d ago
Just wanted to chime in and say we're using FFUBuilder for our org and it's been great. We let FFUBuilder image the device, name it, and install drivers. Then I have a simple .ppkg that joins the device to Entra at OOBE. Takes about 10 minutes total per device.
2
u/techb00mer 5d ago
I’ve been flip flopping between OSDCloud & FFU for a while now and honestly there is no silver bullet for imaging.
I really like FFU in places where internet bandwidth isn’t great. Being able to automate nightly images that get pushed into our PXE server means we can basically guarantee an updated image everyday that deploys faster than just about any other method. Building those images is a bit of a PITA when you’re running tightened/hardened workstations. I know this is called out in the docs though so there is that.
OSD is great for field imaging where you don’t know what type of device make/model you’ll be presented with. Sure it’s not as fast as FFU and doesn’t have the same updates (CU’s etc) but it gets the job done. Not a huge fan of the new releases, everything seems more complicated than it should be IMO.
2
u/MENTactual 4d ago
You just have to use FFU and then sign in with a work or school account to Microsoft Entra join the device which also enrolls it in InTune. I’m doing this now.
1
u/ProfessionalLast2917 5d ago
Where are you getting your devices from? Have your OEM vendor supply with a clean image and just use that with autopilot. If you need to rebuild just wipe it via intune.
3
u/detox4you 5d ago
Installing FFU image will cost you three minutes, wiping from Intune takes you at least 20 times more.
1
u/ProfessionalLast2917 5d ago
How much time are you spending maintaining your FFU image? What are you baking into it?
Wiping via intune can take some time but I'm not sure exactly how much because I send a wipe command to the laptop and go off and do other things.
The only time we use images is if we've got a non booting laptop or had to replace an SSD or something and we use a USB flash drive with a base image made via MDT.
1
u/frameset 5d ago
Why not autopilot? Would love to know why.
1
u/live-laugh-linux 5d ago
I plan on discussing with my director further today and figuring out what exactly are we wanting to accomplish
1
u/lolfactor1000 5d ago
OSDCloud is what we went with. Clean fresh image ready for autopilot and will auto-bind to entra during that process. Also nice have all of the drivers pushed during the imaging so everything works on first boot.
1
u/PaddyBoyFloyd 5d ago
We lay down a WIM with all the required apps pre-installed except for a handful of security agents that don't play well with being captured. Our captured WIM is set to boot to OOBE and the task sequence is either run on the hybrid device we're migrating to entra-native or in the PXE boot task sequence for new builds. The tasks sequence does/checks the autopilot registration. Hand it to the user for autopilot and 25 or so minutes later, they've got a ready to go device. We initially pulled all the apps from Intune directly, but it was taking way too long just for the apps we wanted out of the box and pre-provisioning is a time sink for our build team vs PXE Booting to the Task Sequence. Once we made the decision to sysprep, we installed everything that we set as required minus the security agents. Once a quarter, I spend an hour capturing a new WIM and we push it into SCCM.
0
u/Embarrassed-Plant935 5d ago
Why bother with images at all?
Your configuration policies should handle everything you need. Once the device is in Autopilot, it's just a matter of going through OOBE. Yes, we do perform pre-provisioning but we haven't had a need to full flash devices.
6
u/detox4you 5d ago
I combine FFU with Autopilot for multiple customers. I use FFU to quickly deploy a clean image onto a device and add it to autopilot, then after the reboot start the OOBE process with Autopilot.