跳到主要內容

114: Review provisioning strategy

Implementation Effort: Medium to High
User Impact: High

Overview​

A provisioning strategy determines how Windows devices are joined, enrolled, configured, and handed to users over their full life cycle. In a Zero Trust endpoint program, this should not be a one-size-fits-all choice. New corporate devices, repurposed devices, kiosks, contractor machines, and existing domain-joined devices usually need different onboarding patterns. The right design minimizes standing trust to on-premises infrastructure, favors cloud identity where possible, and keeps the enrollment path supportable at scale.

Implementation Guidance​

  1. Build a scenario matrix before choosing tools. At minimum, separate new corporate devices, existing domain-joined devices, shared or kiosk devices, and personally owned Windows devices.
  2. Use Microsoft Entra join plus Microsoft Intune as the default target for new corporate devices unless a documented dependency still requires hybrid join. For most modern remote and cloud-first scenarios, this is the simplest and most resilient model.
  3. Use Windows Autopilot for new or reset organization-owned devices when you want OEM, reseller, or self-service provisioning. Match the Autopilot mode to the scenario: user-driven, pre-provisioned, self-deploying, or kiosk where supported.
  4. Use co-management intentionally for existing Configuration Manager estates during transition, not as an excuse to avoid setting a cloud target state. Define which workloads move first and which dependencies block the rest.
  5. For personally owned Windows devices, decide whether full enrollment is actually required. In some organizations, browser-based access with Conditional Access and app-level controls is enough; in others, MDM enrollment is required for defined populations.
  6. Document the identity, app delivery, compliance, and remote support experience for each scenario so procurement, desktop engineering, and help desk teams all follow the same path.

Reference​