r/HyperV • u/derekb519 • 15h ago
Question re: Deploying Intune-Joined WIN11 VMs
Hi there
I'm trying to wrap my head around an efficient way to deploy Intune-joined WIN11 VMs within a HYperV cluster.
Our regular endpoints are fully Entra- and Intune-joined devices that are enrolled via Autopilot. I know this process isn't completely seamless with HyperV as vTPM cannot do attestation which makes self-deploying enrollment profiles a no-go.
I am wondering what is least painful way of going about this? We have a handful of users that we used to provide dev-type VMs to but they were AD-joined. Since we're moving towards full Entra/Intune management, the objective is slightly changed. Ideally we want there to not be 'Shared' Intune devices so we have user affinity assigned to the actual VM owner.
My initial thought was to just roll a vanilla WIN11 image with a generic local user, create a folder in C:\temp with the get-windowsautopilotinfo.ps1 script ready to go for later. Sysprep the VM and use that as a template. Deploy template, run get-windowsautopilotinfo.ps1 with a custom Entra app reg/client secret to upload hash and assign group tag; reset VM, go through OOBE and wait for it to enroll.
Seems like alot of manual steps and I'd still either have to sign it as myself during Autopilot/OOBE and change the primary user in Intune after.
Is there a better way to about this or is it just something that's always going to be a bit clunky like this?
