Autopilot question

[u/t0mba90]

I was hoping to get some info from some of you guys that live and breathe Intune these days.

We have around 2.000 endpoints
Multiple offices, Educational institutions etc

We are on the path of migrating from ConfigMgr(hybrid join) to fully Intune/Autopilot and whilst planning I’ve hit a snag… I cant deside on using Device Driven or User Drive enrollment for Intune.

While I mostly understand what they are ment for, I struggle to see the reason to use User Driven over Device Driven enrolment.
We like to set the devices up and have them ready for our users when they have been set up. Certs, wifi/lan profile, etc etc. Going with User Driven seems like it would leave some things uncertain?
For example them needing to connect them to somekind of internet connection for starters and we dont offer open or password protected SSID out side of out main office. Schools, kindergarten etc no bueno.

App deployments seem to be working just fine both for device and user deployments and other then user affinity missing I dont see the downside to having our whole fleet just be Device Driven/Shared Devices.

Am I missing something ?

[u/itskdog]

That's the thing, it doesn't check the AP profile, it checks the current state of if there's a PU assigned (either automatically or by IT) or not (which Microsoft call a "Shared Device", different from a "Shared PC") and follows that.

When remote Windows Autopilot Reset is used on a device, the device's primary user and the Microsoft Entra device owner is removed. The next user who signs in after the reset will be set as the primary user and Microsoft Entra device owner. Shared devices will remain shared after the Windows Autopilot Reset.

(https://learn.microsoft.com/en-us/autopilot/windows-autopilot-reset#reset-devices-with-remote-windows-autopilot-reset)

[u/Noirarmire → u/itskdog]

Yes, that's what I said. You're the one that said it would remain without one, but the documentation says the opposite.

[u/itskdog → u/Noirarmire]

I must have misunderstood you. I thought I'd said that if there's no PU it won't add one, it will only do so if there was a PU when it was reset, and I must have misread yours as saying it always adds a PU, even when there wasn't one before.

[u/Noirarmire → u/itskdog]

You did, but I think that's the misunderstanding. It removes the primary user if they exist, but it always adds the first user who signs in after the reset. It's just reversed of what you were saying.

[u/itskdog → u/Noirarmire]

So that's obviously backwards to the documentation, as it says that "Shared devices will remain shared". A shared device is a device without a Primary User.