diff --git a/devices/surface-hub/images/ICDstart-option.PNG b/devices/surface-hub/images/ICDstart-option.PNG new file mode 100644 index 0000000000..1ba49bb261 Binary files /dev/null and b/devices/surface-hub/images/ICDstart-option.PNG differ diff --git a/devices/surface-hub/images/choose-package.png b/devices/surface-hub/images/choose-package.png new file mode 100644 index 0000000000..2bf7a18648 Binary files /dev/null and b/devices/surface-hub/images/choose-package.png differ diff --git a/devices/surface-hub/images/connect-aad.png b/devices/surface-hub/images/connect-aad.png new file mode 100644 index 0000000000..8583866165 Binary files /dev/null and b/devices/surface-hub/images/connect-aad.png differ diff --git a/devices/surface-hub/images/express-settings.png b/devices/surface-hub/images/express-settings.png new file mode 100644 index 0000000000..99e9c4825a Binary files /dev/null and b/devices/surface-hub/images/express-settings.png differ diff --git a/devices/surface-hub/images/icd-common-settings.png b/devices/surface-hub/images/icd-common-settings.png new file mode 100644 index 0000000000..c2a8eb807f Binary files /dev/null and b/devices/surface-hub/images/icd-common-settings.png differ diff --git a/devices/surface-hub/images/icd-new-project.png b/devices/surface-hub/images/icd-new-project.png new file mode 100644 index 0000000000..8a5c64fa4e Binary files /dev/null and b/devices/surface-hub/images/icd-new-project.png differ diff --git a/devices/surface-hub/images/license-terms.png b/devices/surface-hub/images/license-terms.png new file mode 100644 index 0000000000..8dd34b0a18 Binary files /dev/null and b/devices/surface-hub/images/license-terms.png differ diff --git a/devices/surface-hub/images/oobe.jpg b/devices/surface-hub/images/oobe.jpg new file mode 100644 index 0000000000..53a5dab6bf Binary files /dev/null and b/devices/surface-hub/images/oobe.jpg differ diff --git a/devices/surface-hub/images/prov.jpg b/devices/surface-hub/images/prov.jpg new file mode 100644 index 0000000000..1593ccb36b Binary files /dev/null and b/devices/surface-hub/images/prov.jpg differ diff --git a/devices/surface-hub/images/setupmsg.jpg b/devices/surface-hub/images/setupmsg.jpg new file mode 100644 index 0000000000..12935483c5 Binary files /dev/null and b/devices/surface-hub/images/setupmsg.jpg differ diff --git a/devices/surface-hub/images/sign-in-prov.png b/devices/surface-hub/images/sign-in-prov.png new file mode 100644 index 0000000000..55c9276203 Binary files /dev/null and b/devices/surface-hub/images/sign-in-prov.png differ diff --git a/devices/surface-hub/images/trust-package.png b/devices/surface-hub/images/trust-package.png new file mode 100644 index 0000000000..8a293ea4da Binary files /dev/null and b/devices/surface-hub/images/trust-package.png differ diff --git a/devices/surface-hub/images/who-owns-pc.png b/devices/surface-hub/images/who-owns-pc.png new file mode 100644 index 0000000000..d3ce1def8d Binary files /dev/null and b/devices/surface-hub/images/who-owns-pc.png differ diff --git a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md index a4eb84f063..2379e66d80 100644 --- a/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md +++ b/devices/surface-hub/provisioning-packages-for-certificates-surface-hub.md @@ -13,248 +13,209 @@ localizationpriority: medium # Create provisioning packages (Surface Hub) +This topic explains how to create a provisioning package using the Windows Imaging and Configuration Designer (ICD), and apply it to Surface Hub devices. For Surface Hub, you can use provisioning packages to add certificates, install Universal Windows Platform (UWP) apps, and customize policies and settings. -For Windows 10, settings that use the registry or a content services platform (CSP) can be configured using provisioning packages. You can also add certificates during first run using provisioning. +You can apply a provisioning package using a USB during first run, or through the **Settings** app. -In this topic, you'll find the following information: -- [Introduction to provisioning packages](#intro-prov-pkg) -- [What can provisioning packages configure for Microsoft Surface Hubs?](#what-can-prov-pkg) -- [How do I create and deploy a provisioning package?](#how-do-i-prov-pkg) -- [Requirements](#requirements-prov-pkg) -- [Install the Windows Imaging and Configuration Designer](#installing-wicd-prov-pkg) -- [Create a provisioning package for certificates](#creating-prov-pkg-certs) -- [Create a provisioning package for apps](#creating-prov-pkg-apps) -- [Deploy a provisioning package to a Surface Hub](#deploy-to-hub-prov-pkg) - - [Deploy a provisioning package using first run](#deploy-via-oobe-prov-pkg) - - [Deploy a provisioning package using Settings](#deploy-via-settings-prov-pkg) +## Advantages +- Quickly configure devices without using a MDM provider. -### Introduction to provisioning packages +- No network connectivity required. -Provisioning packages are created using Windows Imaging and Configuration Designer (WICD), which is a part of the Windows Assessment and Deployment Kit (ADK). For Surface Hub, the provisioning packages can be placed on a USB drive. +- Simple to apply. -### What can provisioning packages configure for Surface Hubs? +[Learn more about the benefits and uses of provisioning packages.](https://technet.microsoft.com/itpro/windows/whats-new/new-provisioning-packages) -Currently, you can use provisioning packages to install certificates and to install Universal Windows Platform (UWP) apps on your Surface Hub. These are the only two supported scenarios. -You may use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange or Skype for Business, or to sideload apps that don't come from the Windows Store (for example, your own in-house apps). +## Requirements ->**Note**  Provisioning can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, you must use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details. +To create and apply a provisioning package to a Surface Hub, you'll need the following: -  - -### How do I create and deploy a provisioning package? - -Provisioning packages must be created using the Windows Imaging and Configuration Designer (ICD). - -### Requirements - -In order to create and deploy provisioning packages, all of the following are required: - -- Access to the Settings app on Surface Hub (using admin credentials which were configured at initial setup of the Surface Hub). -- Windows Imaging and Configuration Designer (ICD), which is installed as a part of the windows 10 Assessment and Deployment Kit (ADK). +- Windows Imaging and Configuration Designer (ICD), which is installed as a part of the [Windows 10 Assessment and Deployment Kit (ADK)](http://go.microsoft.com/fwlink/p/?LinkId=526740). - A PC running Windows 10. -- USB flash drive. +- A USB flash drive. +- If you apply the package using the **Settings** app, you'll need device admin credentials. -### Install the Windows Imaging and Configuration Designer +You'll create the provisioning package on a PC running Windows 10, save the package to a USB drive, and then deploy it to your Surface Hub. -1. The Windows Imaging and Configuration Designer (ICD) is installed as part of the Windows 10 ADK. The installer for the ADK can be downloaded from the [Microsoft Download Center](https://go.microsoft.com/fwlink/?LinkId=718147). - >**Note**  The ADK must be installed on a separate PC, not on the Surface Hub.   -2. Run the installer, and set your preferences for installation. When asked what features you want to install, you will see a checklist like the one in the following figure. Note that **Windows Performance Toolkit** and **Windows Assessment Toolkit** should be unchecked, as they are not needed to run the ICD. +## Supported items for Surface Hub provisioning packages - Before going to the next step, make sure you have the following checked: +Currently, you can add these items to provisioning packages for Surface Hub: +- **Certificates** - You can add certificates, if needed, to support Microsoft Exchange and UWP apps downloaded from the Windows Store for Business. +- **Universal Windows Platform (UWP) apps** - You can install UWP apps. This can be an offline-licensed app from the Windows Store for Business, or an app created by an in-house dev. +- **Policies** - Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. +- **Settings** - You can configure any setting in the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx). - - **Deployment Tools** - - **Windows Preinstallation Environment** - - **Imaging and Configuration Designer** - - **User State Migration Tool** - All four of these features are required to run the ICD and create a package for the Surfact Hub. +## Create the provisioning package - ![Image showing Windows ADK install page - select features to install.](images/idcfeatureschecklist.png) +Use the Windows Imaging and Configuration Designer (ICD) tool included in the Windows Assessment and Deployment Kit (ADK) for Windows 10 to create a provisioning package. When you install the ADK, you can choose to install only the Imaging and Configuration Designer (ICD). [Install the ADK.](http://go.microsoft.com/fwlink/p/?LinkId=526740) -3. Continue with the installer until the ADK is installed. This may take a while, because the installer downloads remote content. +1. Open Windows ICD (by default, `%windir%\Program Files (x86)\Windows Kits\10\Assessment and Deployment Kit\Imaging and Configuration Designer\x86\ICD.exe`). -### Create a provisioning package for certificates +2. Click **Advanced provisioning**. -This example will demonstrate how to create a provisioning package to install a certificate. + ![ICD start options](images/ICDstart-option.PNG) + +3. Name your project and click **Next**. -1. On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu. +4. Select **Common to Windows 10 Team edition**, click **Next**, and then click **Finish**. - ![Image showing Start page in Windows Imaging and Configuration Designer.](images/wicd-screen01a.png) + ![ICD new project](images/icd-new-project.png) -2. When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**. +5. In the project, under **Available customizations**, select **Common Team edition settings**. - ![Image showing New project screen for Windows Imaging and Configuration Designer.](images/wicd-screen02a.png) + ![ICD common settings](images/icd-common-settings.png) - Select the settings that are **Common to all Windows editions**, and click **Next**. - ![Image showing project settings in Windows Imaging and Configuration Designer.](images/wicd-screen02b.png) +### Add a certificate to your package +You can use provisioning packages to install certificates that will allow the device to authenticate to Microsoft Exchange, or to install apps downloaded from the Windows Store. - When asked to import a provisioning package, just click **Finish.** +> [!NOTE] +> Provisioning packages can only install certificates to the device (local machine) store, and not to the user store. If your organization requires that certificates must be installed to the user store, use Mobile Device Management (MDM) to deploy these certificates. See your MDM solution documentation for details. - ![Image showing option for importing a provisioning package.](images/wicd-screen02c.png) +1. In the **Available customizations** pane, go to **Runtime settings** > **Certificates** > **ClientCertificates**. -3. ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **Runtime settings** and then expand **Certificates**. Click **Root certificates**. +2. Enter a **CertificateName** and then click **Add**. - ![Image showing Windows Imaging and Configuration Designer's man page.](images/wicd-screen03a.png) +2. Enter the **CertificatePassword**. - In the center pane, you’ll be asked to specify a **CertificateName** for the Root certificate. You can set this to whatever you want. For the example, we've used the same name as the project. Click **Add**, and an entry will be added in the left pane. +3. For **CertificatePath**, browse and select the certificate. -4. In the **Available customizations** pane on the left, a new category has appeared for **CertificatePath** underneath the **CertificateName** you provided. There’s also a red exclamation icon indicating that there is a required field that needs to be set. Click **CeritficatePath**. +4. Set **ExportCertificate** to **False**. - ![Image showing available customizations in Windows Imaging and Configuration Designer.](images/wicd-screen04a.png) +5. For **KeyLocation**, select **Software only**. -5. In the center pane, you’ll be asked to specify the path for the certificate. Enter the name of the .cer file that you want to deploy, either by typing or clicking **Browse**. It must be a root certificate. The provisioning package created will copy the .cer file into the package it creates. - ![icd tiles](images/wicd-screen06a.png) +### Add a Universal Windows Platform (UWP) app to your package +Before adding a UWP app to a provisioning package, you need the app package (either an .appx, or .appxbundle) and any dependency files. If you acquired the app from the Windows Store for Business, you will also need the *unencoded* app license. See [Distribute offline apps](https://technet.microsoft.com/itpro/windows/manage/distribute-offline-apps#download-an-offline-licensed-app) to learn how to download these items from the Windows Store for Business. -6. Verify that the path is set, then click **Export** in the top menu and choose **Provisioning package**. +1. In the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextApp**. - ![icd tiles](images/wicd-screen07a.png) +2. Enter a **PackageFamilyName** for the app and then click **Add**. For consistency, use the app's package family name. If you acquired the app from the Windows Store for Business, you can find the package family name in the app license. Open the license file using a text editor, and use the value between the \...\ tags. -7. You'll see a series of dialog boxes next. In the first one, either accept the defaults, or enter new values as needed, and click **Next**. You'll most likely want to accept the defaults. +3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). - ![icd tiles](images/wicd-screen08a.png) +4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. For Surface Hub, you will only need the x64 versions of these dependencies. - Click **Next** again in the security options dialog box, because this package doesn't need to be encrypted or signed. +If you acquired the app from the Windows Store for Business, you will also need to add the app license to your provisioning package. - ![icd tiles](images/wicd-screen09a.png) +1. Make a copy of the app license, and rename it to use a **.ms-windows-store-license** extension. For example, "example.xml" becomes "example.ms-windows-store-license". - Choose where to save the provisioning package, and click **Next**. +2. In ICD, in the **Available customizations** pane, go to **Runtime settings** > **UniversalAppInstall** > **DeviceContextAppLicense**. - ![icd tiles](images/wicd-screen10a.png) +3. Enter a **LicenseProductId** and then click **Add**. For consistency, use the app's license ID from the app license. Open the license file using a text editor. Then, in the \ tag, use the value in the **LicenseID** attribute. - Review the information shown, and if it looks good, click **Build**. +4. Select the new **LicenseProductId** node. For **LicenseInstall**, click **Browse** to find and select the license file that you renamed in Step 1. - ![icd tiles](images/wicd-screen11a.png) - You will see a confirmation dialog box similar to the one following. Click the link under **Output location** to open the directory containing the provisioning package. +### Add a policy to your package +Surface Hub supports a subset of the policies in the [Policy configuration service provider](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx). Some of those policies can be configured with ICD. - ![icd tiles](images/wicd-screen12a.png) +1. In the **Available customizations** pane, go to **Runtime settings** > **Policies**. -8. Copy the .ppkg from the output directory into the root directory of a USB drive. If it’s not at the root, it won’t be recognized by the device. You’ve finished making the provisioning package—now you just need to deploy it to the Surface Hub. +2. Select one of the available policy areas. -### Create a provisioning package for apps +3. Select and set the policy you want to add to your provisioning package. -This example will demonstrate how to create a provisioning package to install offline-licensed apps purchased from the Windows Store for Business. For information on offline-licensed apps and what you need to download in order to install them, see [Distribute offline apps](https://go.microsoft.com/fwlink/?LinkId=718148). -For each app you want to install on Surface Hubs, you'll need to download: +### Add Surface Hub settings to your package -- App metadata -- App package -- App license +You can add settings from the [SurfaceHub configuration service provider](https://msdn.microsoft.com/library/windows/hardware/mt608323.aspx) to your provisioning package. -Depending on the app, you may or may not need to download a new app framework. +1. In the **Available customizations** pane, go to **Runtime settings** > **WindowsTeamSettings**. -1. On the PC that had the Windows 10 ADK installed, open ICD and choose the **New provisioning package** tile from the main menu. +2. Select one of the available setting areas. - ![icd tiles](images/wicd-screen01a.png) +3. Select and set the setting you want to add to your provisioning package. -2. When the **New project** dialog box opens, type whatever name you like in the **Name** box. The **Location** and **Description** boxes can also be filled at your discretion, though we recommend using the **Description** box to help you distinguish among multiple packages. Click **Next**. - ![icd tiles](images/wicd-screen-apps-02a.png) +## Build your package - Select the settings that are **Common to all Windows desktop editions**, and click **Next**. +1. When you are done configuring the provisioning package, on the **File** menu, click **Save**. - ![icd tiles](images/wicd-screen02b.png) +2. Read the warning that project files may contain sensitive information, and click **OK**. - When asked to import a provisioning package, just click **Finish.** + > [!IMPORTANT] + > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. - ![icd tiles](images/wicd-screen02c.png) +3. On the **Export** menu, click **Provisioning package**. -3. ICD's main screen will be displayed. This is where you create the provisioning package. In the **Available customizations** pane, expand **UniversalAppInstall** and click **DeviceContextApp**. +4. Change **Owner** to **IT Admin**, which will set the precedence of this provisioning package higher than provisioning packages applied to this device from other sources. - ![icd tiles](images/wicd-screen-apps-03a.png) +5. Set a value for **Package Version**, and then select **Next.** - In the center pane, you’ll be asked to specify a **PackageFamilyName** for the app. This is one of the things you downloaded from the Store for Business. Click **Add**, and an entry will be added in the left pane. + > [!TIP] + > You can make changes to existing packages and change the version number to update previously applied packages. -4. In the **Available customizations** pane on the left, new categories will be displayed for **ApplicationFile** and **LaunchAppAtLogin** underneath the **PackageFamilyName** you just entered. Enter the appx filename in the **ApplicationFile** box in the center pane. +6. Optional: You can choose to encrypt the package and enable package signing. - ![icd tiles](images/wicd-screen-apps-04a.png) + - **Enable package encryption** - If you select this option, an auto-generated password will be shown on the screen. - Generally, **LaunchAppAtLogin** should be set to **Do not launch app** or **NOT CONFIGURED**. + - **Enable package signing** - If you select this option, you must select a valid certificate to use for signing the package. You can specify the certificate by clicking **Browse...** and choosing the certificate you want to use to sign the package. -5. Next, click **DeviceContextAppLicense** in the left pane. In the center pane, you’ll be asked to specify the **LicenseProductId**. Click **Add**. Back in the left pane, click on the **LicenseProductId** that you just added. In the center pane, you'll need to specify **LicenseInstall**. Enter the name of the license file that you previously downloaded from the Store for Business, either by typing or clicking **Browse**. The file will have a extension of "ms-windows-store-license". + > [!IMPORTANT] + > We recommend that you include a trusted provisioning certificate in your provisioning package. When the package is applied to a device, the certificate is added to the system store and any package signed with that certificate thereafter can be applied silently.  - ![icd tiles](images/wicd-screen-apps-06a.png) +7. Click **Next** to specify the output location where you want the provisioning package to go once it's built. By default, Windows ICD uses the project folder as the output location.

+Optionally, you can click **Browse** to change the default output location. -6. Verify that the path is set, then click **Export** in the top menu and choose **Provisioning package**. +8. Click **Next**. - ![icd tiles](images/wicd-screen07a.png) +9. Click **Build** to start building the package. The project information is displayed in the build page and the progress bar indicates the build status.

+If you need to cancel the build, click **Cancel**. This cancels the current build process, closes the wizard, and takes you back to the **Customizations Page**. -7. You'll see a series of dialog boxes next. In the first one, either accept the defaults, or enter new values as needed, and click **Next**. You'll most likely want to accept the defaults. +10. If your build fails, an error message will show up that includes a link to the project folder. You can scan the logs to determine what caused the error. Once you fix the issue, try building the package again.

+If your build is successful, the name of the provisioning package, output directory, and project directory will be shown. - ![icd tiles](images/wicd-screen-apps-08a.png) + - If you choose, you can build the provisioning package again and pick a different path for the output package. To do this, click **Back** to change the output package name and path, and then click **Next** to start another build. + + - If you are done, click **Finish** to close the wizard and go back to the **Customizations Page**. - Click **Next** again in the security options dialog box, because this package doesn't need to be encrypted or signed. +11. Select the **output location** link to go to the location of the package. Copy the .ppkg to an empty USB flash drive. - ![icd tiles](images/wicd-screen09a.png) - Choose where to save the provisioning package, and click **Next**. +## Apply a provisioning package to Surface Hub - ![icd tiles](images/wicd-screen-apps-10a.png) +There are two options for deploying provisioning packages to a Surface Hub. You can apply a provisioning packing [during the first run wizard](#apply-a-provisioning-package-during-first-run), or using [Settings](#apply-a-package-using-settings). - Review the information shown, and if it looks good, click **Build**. - ![icd tiles](images/wicd-screen-apps-11a.png) +### Apply a provisioning package during first run - You will see a confirmation dialog box similar to the one following. Click the link under **Output location** to open the directory containing the provisioning package. +> [!IMPORTANT] +> Only use provisioning packages to install certificates during first run. Use the **Settings** app to install apps and apply other settings. - ![icd tiles](images/wicd-screen-apps-12a.png) +1. When you turn on the Surface Hub for the first time, the first-run program will display the [**Hi there page**](first-run-program-surface-hub.md#first-page). Make sure that the settings are properly configured before proceeding. -8. Copy the .ppkg from the output directory into the root directory of a USB drive. If it’s not at the root, it won’t be recognized by the device. You’ve finished making the provisioning package—now you just need to deploy it to the Surface Hub. +2. Insert the USB flash drive containing the .ppkg file into the Surface Hub. If the package is in the root directory of the drive, the first-run program will recognize it and ask if you want to set up the device. Select **Set up**. -### Deploy a provisioning package to a Surface Hub + ![Set up device?](images/provisioningpackageoobe-01.png) -The following two methods for deploying provisioning packages apply to any kind of provisioning package that is being deployed to a Surface Hub. There is no difference in the way cert provisioning packages and app provisioning packages are installed. You may see different description text in the UI depending on what the package is for, but the process is still the same. +3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. -### Deploy a provisioning package using first run + ![Provision this device](images/provisioningpackageoobe-02.png) + +4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. Note that you can only install one package during first run. -1. When you turn on the Surface Hub for the first time, the first run process will display the page titled **Hi there**. Make sure the settings on this page are correct before you proceed. (See [Hi there page](first-run-program-surface-hub.md#first-page) for details.) Once you've deployed your provisioning package, the first run process will not return here. It will continue to the next screen. -2. Insert the USB drive into the Surface Hub. -3. Press the Windows key on the separate keyboard five times. You’ll see a dialog box asking whether you want to set up your device. Click **Set Up**. + ![Choose a package](images/provisioningpackageoobe-03.png) - ![image with set up device message for surface hub.](images/provisioningpackageoobe-01.png)IMage +5. The first-run program will show you a summary of the changes that the provisioning package will apply. Select **Yes, add it**. The package will be applied, and you'll be taken to the next page in the first-run program. -4. Click on **Removable Media** in the **Provision From** dropdown list, then click **Next**. + ![Do you trust this package?](images/provisioningpackageoobe-04.png) - ![image with provision this device page for surface hub. ](images/provisioningpackageoobe-02.png) -5. The available packages in the root directory of the USB drive will be listed. Note that you can only install one package during first run. Select the package you want to install and then click **Next**. +### Apply a package using Settings - ![image with choose a package page for surface hub. ](images/provisioningpackageoobe-03.png) - -6. You’ll then see a dialog asking if it’s from a source you trust. Click **Yes, add it**. The certificate will be installed, and you’ll be taken to the next page of first run. - - ![image with ](images/provisioningpackageoobe-04.png) - -### Deploy a provisioning package using Settings - -1. Insert the USB drive into the Surface Hub you want to deploy to. -2. On the Surface Hub, open **Settings** and enter in the admin credentials. -3. Navigate to **System > Work Access**. Under the header **Related settings**, click on **Add or remove a management package**. -4. Here, click the button for **Add a package**. - - ![Image showing provisioining packages page in Settings.](images/provisioningpackagesettings-01.png) - -5. Click **Removable media** from the dropdown list. You will see a list of available provisioning packages on the **Settings** page. - - ![Image showing add a package page in Settings.](images/provisioningpackagesettings-02.png) - -6. Choose your package and click **Add**. - - ![Image showing select a package box.](images/provisioningpackagesettings-03.png) - -7. You may have to re-enter the admin credentials if User Access Control (UAC) asks for them. -8. You’ll see a confirmation dialog box. Click **Yes, add it**. The certificate will be installed. - -  - -  +1. Insert the USB flash drive containing the .ppkg file into the Surface Hub. +2. From the Surface Hub, start **Settings** and enter the admin credentials when prompted. +3. Navigate to **This device** > **Device management**. Under **Provisioning packages**, select **Add or remove a provisioning package**. +4. Select **Add a package**. +5. Choose your provisioning package and select **Add**. You may have to re-enter the admin credentials if prompted. +6. You'll see a summary of the changes that the provisioning package will apply. Select **Yes, add it**.