deepblue/windows-itpro-docs
1
0
Fork 0
mirror of https://github.com/MicrosoftDocs/windows-itpro-docs.git synced 2025-05-13 22:07:22 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

0.5

Browse Source
This commit is contained in:
Paolo Matarazzo 2022-08-15 13:56:51 -04:00
parent 5b666ef3e1
commit ad073d4541
6 changed files with 26 additions and 88 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
education/windows/school-deployment/enrollment-autopilot.md
View File

@ -33,7 +33,7 @@ Before setting up Windows Autopilot, consider these prerequisites:
- **Intune for Education tenant. Ensure your tenant for Intune for Education is set up. We recommend configuring your tenant with** [**School Data Sync**](#)**, as this method automatically creates Student and Teacher groups for each school, as well as a combined Teacher and Student group. It also creates tenant-wide All Teachers and All Student groups.**
- **Networking requirements.** Ensure students know to connect to the school network during OOBE setup. For more information on managing devices behind firewalls and proxy servers, see [Network endpoints for Microsoft Intune](/mem/intune/fundamentals/intune-endpoints).
**NOTE:** Where not explicitly specified, both HTTPS (443) and HTTP (80) must be accessible. If you are auto-enrolling your devices into Microsoft Intune or deploying Microsoft Office, follow the networking guidelines for [Microsoft Intune](https://docs.microsoft.com/intune/network-bandwidth-use) and [Microsoft 365](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2).
**NOTE:** Where not explicitly specified, both HTTPS (443) and HTTP (80) must be accessible. If you are auto-enrolling your devices into Microsoft Intune or deploying Microsoft Office, follow the networking guidelines for [Microsoft Intune](/intune/network-bandwidth-use) and [Microsoft 365](https://support.office.com/article/Office-365-URLs-and-IP-address-ranges-8548a211-3fe7-47cb-abb1-355ea5aa88a2).
### Register devices to Windows Autopilot

32
education/windows/school-deployment/enrollment-overview.md
View File

@ -19,27 +19,25 @@ appliesto:
# Device enrollment overview
Enrolling large numbers of Windows 11 SE devices to Azure Active Directory and Intune for Education can help save time, effort, and cost. There are four methods for setting up Windows 11 SE devices and enrolling them in your education tenant:
There are three methods for setting up Windows devices and enrolling them in your education tenant:
- **Windows Autopilot.** Uses cloud-based technologies and services to set up and configure Windows devices with a zero-touch deployment approach. Windows Autopilot helps simplify the Windows device lifecycle, from initial deployment to end of life, for both IT administrators and end users. For more information, see [Overview of Windows Autopilot](/mem/autopilot/windows-autopilot).
- **Windows Autopilot** uses cloud-based technologies and services to set up and configure Windows devices with a zero-touch deployment approach. Windows Autopilot helps simplify the Windows device lifecycle, from initial deployment to end of life, for both IT administrators and end users. For more information, see [Overview of Windows Autopilot](/mem/autopilot/windows-autopilot)
> [!NOTE]
> There are some limitations to Windows Autopilot in Windows 11 SE. For more information, see [Device settings](/intune-education/windows-11-se-overview#windows-autopilot).
**NOTE:** There are some limitations to Windows Autopilot in Windows 11 SE. For more information, see [Device settings](https://docs.microsoft.com/intune-education/windows-11-se-overview).
- **Set Up School PCs app.** Configures devices with the apps and features students need, removing those they do not need. You create a provisioning package with the app and then automatically install the package to enroll devices into Intune for Education. For more information, see [Use the Set Up School PCs app](/education/windows/use-set-up-school-pcs-app).
- **Windows Configuration Designer.** Configures end-user devices without imaging. Using Windows provisioning, you can specify the desired configuration for enrollment and then apply those settings to target devices in minutes. Windows Configuration Designer is best suited for small to medium schools with deployments that range from tens to a few hundred computers. It is offered as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). For more information, see [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd).
- **Manual out-of-the-box experience (OOBE).** Requires the user’s school credentials. This experience happens when a user first opens a new device preinstalled with Windows 11 SE. It enables the user to customize certain functionality before reaching the desktop. Keep in mind that when using the manual OOBE, there is a lack of support for the [Device Firmware Configuration Interface](#) (DFCI). In addition, users going through this flow will automatically become local administrators on their devices, which can cause management issues.
- **Provisioning packages** are files that you can use to set up Windows devices. You can create provisioning packages using either **Set Up School PCs** or **Windows Configuration Designer** applications. One benefit of provisioning packages is that you can use them to set up Windows devices that are not registered in Windows Autopilot. These files can be applied during or after the out-of-box experience. For more information, see [Provisioning packages](/windows/configuration/provisioning-packages/provisioning-apply-package).
- **Manual out-of-the-box experience (OOBE).** This experience happens when a user first turns on a new device and it enables the user to customize certain Windows functionalities before reaching the desktop. When using this approach, users going through this flow will automatically become local administrators on the devices, which can cause issues for education devices.
## Choosing the best method
Also, note that DFCI management is not supported with Set Up School PCs enrollment.
________________________________________________________
## Section review and next steps
In this section, we reviewed four methods for device enrollment. Windows Autopilot and the Set up School PCs app are usually the most efficient options for school environments. There are various elements to take under consideration when choosing between Windows Autopilot and the Set up School PCs app. This [table](/intune-education/add-devices-windows) describes the ideal scenarios for using either method. It is recommended to review the table when making your enrollment and deployment plan.
Windows Autopilot and the Set up School PCs app are usually the most efficient options for school environments. There are various elements to take under consideration when choosing between Windows Autopilot and the Set up School PCs app. This [table](/intune-education/add-devices-windows) describes the ideal scenarios for using either method. It is recommended to review the table when making your enrollment and deployment plan.
Select one of the following options to learn more about the enrollment method you chose:
> [!div class="nextstepaction"]
> [< Set up Microsoft Intune](set-up-microsoft-intune.md)
> [Windows Autopilot >](enrollment-oobe.md)
> [Provisioning Package>](enrollment-oobe.md)
> [Manual >](enrollment-oobe.md)
> [> Windows Autopilot >](enrollment-autopilot.md)
> [!div class="nextstepaction"]
> [> Provisioning Package >](enrollment-package.md)
> [!div class="nextstepaction"]
> [> Manual OOBE >](enrollment-oobe.md)

35
education/windows/school-deployment/enrollment-suspcs.md
View File

@ -1,35 +0,0 @@
---
title: # Microsoft Endpoint Manager support
description: # How to obtain Microsoft support from Microsoft Endpoint Manager admin center.
ms.date: 08/31/2022
ms.prod: windows
ms.technology: windows
ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
ms.localizationpriority: medium
author: paolomatarazzo
ms.author: paoloma
#ms.reviewer:
manager: aaroncz
ms.collection: education
appliesto:
- ✅ <b>Windows 10</b>
- ✅ <b>Windows 11</b>
---
# Set up School PCs
The Set Up School PCs app is especially useful in scenarios where large numbers of school-owned devices need to be enrolled. The app helps you configure Surface Laptop SE devices with the features students need, remove those they do not need, and enroll the devices into Intune for Education. With the Set Up School PCs app, you create a provisioning package to enroll devices using a USB drive. For more information on prerequisites, configuration, and recommendations, see [Use the Set Up School PCs app](/education/windows/use-set-up-school-pcs-app).
### Create the provisioning package
The Set Up School PCs app guides you through configuration choices for school-owned devices. Review the [Set Up School PCs demo](https://www.microsoft.com/en-us/education/interactive-demos/enroll-devices-at-scale) to step through how to create provisioning packages and save them to USB.
![Configure device settings in Set Up School PCs app](./image12.png)
**NOTE:** Importantly, for **Configure device settings** → **OS version**, you must select **Windows 11 SE**.
The devices will be joined to Azure Active Directory and automatically enrolled in Intune. Note that the Set Up School PCs app will configure many settings, allowing you to optimize devices for shared use and other scenarios.
### Provision devices with USB
To provision Surface Laptop SE devices with USB, insert the provisioning package saved to USB during manual OOBE. For more information, see [Run package - Install package on PC](/education/windows/use-set-up-school-pcs-app), which steps through running and installing the provisioning package.

23
education/windows/school-deployment/enrollment-wcd.md
View File

@ -1,23 +0,0 @@
---
title: # Microsoft Endpoint Manager support
description: # How to obtain Microsoft support from Microsoft Endpoint Manager admin center.
ms.date: 08/31/2022
ms.prod: windows
ms.technology: windows
ms.topic: conceptual #reference troubleshooting how-to end-user-help overview (more in contrib guide)
ms.localizationpriority: medium
author: paolomatarazzo
ms.author: paoloma
#ms.reviewer:
manager: aaroncz
ms.collection: education
appliesto:
- ✅ <b>Windows 10</b>
- ✅ <b>Windows 11</b>
---
# Windows Configuration Designer
Windows Configuration Designer is especially useful in scenarios where a school needs to provision packages for both bring-you-own devices and school-owned devices. Ideal for small-to-medium schools that manage up to a few hundred devices, Windows Configuration Designer lets you configure devices without imaging. For more information, see [Install Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-install-icd), which provides details about the app, its provisioning process, and considerations for its use.
![Set up device page in Windows Configuration Designer](./image13.png)

16
education/windows/school-deployment/set-up-microsoft-intune.md
View File

@ -21,11 +21,11 @@ appliesto:
Without the proper tools and resources, managing hundreds or thousands of devices in a school environment can be a complex and time-consuming task. Microsoft Endpoint Manager provides a collection of services that simplifies the management of devices at scale.
Microsoft Intune is one of the services provided by Microsoft Endpoint Manager. The Microsoft Intune service can be managed in different ways, and one of them is **Intune for Education**, a web portal specifically designed for education environments.
Microsoft Intune is one of the services provided by Microsoft Endpoint Manager. The Microsoft Intune service can be managed in different ways, and one of them is **Intune for Education**, a web portal designed for education environments.
:::image type="content" source="./images/intune-education-portal.png" alt-text="Intune for Education dashboard" border="true":::
Intune for Education supports the entire device lifecycle, from the enrollment phase through retirement. IT administrators can start managing classroom devices with bulk enrollment options and a streamlined deployment. At the end of the school year, IT admins can reset or wipe devices, ensuring they are ready for the next year.
Intune for Education supports the entire device lifecycle, from the enrollment phase through retirement. IT administrators can start managing classroom devices with bulk enrollment options and a streamlined deployment. At the end of the school year, IT admins can reset or wipe devices, ensuring they're ready for the next year.
For more information, see [Intune for Education documentation](/intune-education/what-is-intune-for-education).
@ -51,7 +51,7 @@ The Intune service can be configured in different ways, depending on the needs o
With enrollment restrictions, you can prevent certain types of devices from being enrolled and therefore managed by Intune. For example, you can prevent the enrollment of devices that are not owned by the school.
To block personally-owned Windows devices from enrolling:
To block personally owned Windows devices from enrolling:
1. Sign in to the <a href="https://endpoint.microsoft.com/" target="_blank"><b>Microsoft Endpoint Manager admin center</b></a>
1. Select **Devices** > **Enroll devices** > **Enrollment device platform restrictions**
@ -80,7 +80,7 @@ For more information, see [Set up the Enrollment Status Page](/mem/intune/enroll
### Disable Windows Hello for Business
Windows Hello for Business is a biometric authentication feature that allows users to sign in to their devices using a PIN, password, or fingerprint. Windows Hello for Business is enabled by default on Windows devices, and to set it up, users must perform for multi-factor authentication (MFA). As a result, this feature may not be ideal for students, who may not have MFA enabled.
It is suggested to disable Windows Hello for Business on Windows devices at the tenant level, and enabling it only for devices that need it, for example for teachers and staff devices.
It's suggested to disable Windows Hello for Business on Windows devices at the tenant level, and enabling it only for devices that need it, for example for teachers and staff devices.
To disable Windows Hello for Business at the tenant level:
1. Sign in to the <a href="https://endpoint.microsoft.com/" target="_blank"><b>Microsoft Endpoint Manager admin center</b></a>
@ -97,7 +97,7 @@ For more information how to enable Windows Hello for Business on specific device
With Intune for Education, you can configure settings for users and devices in the school. Settings can be assigned to groups:
- If you target settings to a **group of users**, those settings will apply, regardless of what managed devices the targeted users log in to
- If you target settings to a **group of users**, those settings will apply, regardless of what managed devices the targeted users sign in to
- If you target settings to a **group of devices**, those settings will apply regardless of who is using the devices
There are two ways to manage settings in Intune for Education:
@ -110,7 +110,7 @@ There are two ways to manage settings in Intune for Education:
### Configure settings with Express Configuration
With Express Configuration, you can get Intune for Education up and running in just a few steps. You can select a group of devices or users, pick applications that you want to distribute, and choose key settings from those most commonly used in schools.
With Express Configuration, you can get Intune for Education up and running in just a few steps. You can select a group of devices or users, select applications to distribute, and choose settings from the most commonly used in schools.
For more information, see [Express Configuration in Intune for Education](/intune-education/express-configuration-intune-edu).
@ -165,5 +165,5 @@ ________________________________________________________
With the Intune service configured, you can start enrolling and managing students' and teachers' devices.
> [!div class="nextstepaction"]
> [< Set up your tenant](set-up-your-tenant.md)
> [Enroll devices >](enrollment-overview.md)
> [< Set up your tenant <](set-up-your-tenant.md)
> [> Enroll devices >](enrollment-overview.md)

6
education/windows/school-deployment/toc.yml
View File

@ -15,10 +15,8 @@ items:
href: enrollment-overview.md
- name: Enroll devices with Windows Autopilot
href: enrollment-autopilot.md
- name: Enroll devices with Set up School PCs
href: enrollment-suspcs.md
- name: Enroll devices with Windows Configuration Designer
href: enrollment-wcd.md
- name: Enroll devices with provisioning packages and SUSPCs
href: enrollment-package.md
- name: Enroll devices manually
href: enrollment-oobe.md
- name: Manage devices with Intune