Enrolling Windows Devices Using Azure AD: Workspace ONE UEM Operational Tutorial

VMware Workspace ONE UEM 2105 and later

Overview

Introduction

Note: This content was created for Windows 10, but the basic principles and tasks outlined also apply to your deployment of Windows 11.

VMware provides this operational tutorial to help you with your VMware Workspace ONE® environment. This tutorial provides you with practical information and exercises to help you set up Windows device onboarding to your Workspace ONE UEM environment, in conjunction with Microsoft Azure Active Directory (AAD) for authentication.

Audience

This operational tutorial is intended for IT professionals and Workspace ONE administrators of existing production environments. 

Both current and new administrators can benefit from using this tutorial. Familiarity with Windows Out of Box Experience (OOBE), Microsoft Active Directory (AD), and Microsoft Azure Active Directory (AAD) is assumed.

Knowledge of additional technologies such as VMware Workspace ONE® Intelligence and VMware Workspace ONE® UEM is also helpful.

Integrating Microsoft Azure Active Directory (AAD) with Workspace ONE UEM

Azure Active Directory Integration Use-Cases

TIP: Workspace ONE Drop Ship Provisioning enhances Autopilot functionality!

Workspace ONE Drop Ship Provisioning supports the following Active Directory (AD) Types (use cases):

  • Active Directory Domain Join
    • Ability to join the on-premises active directory domain. The device needs access to the domain when booting up for the first time in order to join the domain successfully.
  • Azure Active Directory Basic
    •  Ability to join AAD without a premium license and still enroll in Workspace ONE UEM
  • Azure Active Directory Premium
    •  Ability to join AAD with the option of using Autopilot as well.
  • Workgroup
    •  Enrolls device into Workspace ONE UEM using a local Windows account.

For more information on Workspace ONE Drop Ship Provisioning, see Drop Ship Provisioning: VMware Workspace ONE Operational Tutorial

Azure Active Directory Integration Use-Cases

VMware Workspace ONE UEM integrates with Microsoft Azure Active Directory (AAD), providing a robust selection of onboarding workflows that apply to a wide range of Windows desktop use cases. However, Azure licensing requirements stipulate that you must purchase an additional Azure AD Premium license to complete this integration.

Enterprises that are leveraging Azure AD typically use one of the following on-boarding options:

Corporate-Owned Devices

Employee-Owned Devices
  • Enroll using Azure Autopilot 
    • OOBE +Customized device experience
  • Enroll using Azure Out-of-Box-Experience (OOBE)
    • Signing in with corporate credentials at login
  • Enroll using Azure AD Join
    • Signing in with corporate credentials at login after logging into Operating System
  • Enroll with Office Applications using Azure Connect (Azure AD Join)

Prerequisites and Planning

Prerequisites

Microsoft Azure AD is generally used for onboarding new devices and may already be used to co-manage existing SCCM-managed devices. As you perform this tutorial, ensure that separate Active Directory groups are configured when configuring integration with Azure AD and Workspace ONE UEM.

Before you can perform the procedures in this tutorial, verify that your system meets the following prerequisites:

  • Workspace ONE UEM Admin Account.
  • Microsoft Azure AD Premium P1 or greater license, or any Microsoft bundle which includes this license.
  • Microsoft Azure AD Admin Account to configure integration with Workspace ONE UEM.
  • To integrate a custom (or non-VMware) Workspace ONE UEM domain, e.g., https://*.awmdm.com, then ensure that your custom domain is validated in Azure. In the Azure Active Directory portal, add a custom domain for your domain name with Microsoft Azure. You can follow Microsoft's documentation: Add your custom domain name using the Azure Active Directory portal. For further details, refer to the Workspace ONE UEM On-Premises or Dedicated Saas  Environments section of this guide. 

Planning Your Implementation

Understanding Azure AD Integration Methods

Azure AD supports 2 main integration and sync options to directory services. These include :

  1. Azure AD Cloud Authentication including
    • Azure AD password hash synchronization. Users can use the same credentials that they use on-premises without having to deploy any additional infrastructure. Some premium features of Azure AD, like Identity Protection and Azure AD Domain Services, require password hash synchronization, no matter which authentication method you choose.
    • Azure AD Pass-through Authentication. Provides a simple password validation for Azure AD authentication services by using a software agent that runs on one or more on-premises servers. The servers validate the users directly with your on-premises Active Directory, which ensures that the password validation doesn't happen in the cloud.
  2. Federated authentication
    • When you choose this authentication method, Azure AD hands off the authentication process to a  separate trusted authentication system.
    • This system can be an on-premises Active Directory Federation Services (AD FS), or an Identity Provider (IDP) which supports both WS-Trust and WS-Fed protocols, to validate the user’s credentials.

These methods are important to understand as this is how the user will sign into the device when using OOBE or AutoPilot.

Integrating AAD into Workspace ONE

Integration with Azure Active Directory in Workspace ONE UEM has a dependency on information in traditional Windows Active Directory environments. This information is synced from AD to Azure AD, Workspace ONE UEM, and Workspace ONE Access. It provides a common attribute that the systems depend upon to perform certain operations in Workspace ONE Intelligent Hub and between the services. 

Customers who require the entire operation of Workspace ONE Intelligent Hub, including the Workspace ONE unified app catalog, should sync user accounts from Active Directory with the appropriate sync tools or connectors from VMware and Microsoft. This is also the recommended method from VMware.

Example:

This guide will use the Hybrid Azure AD Integration method will obtain an Immutable ID attribute. This Immutable ID attribute is required in later steps.

Azure AD Integration flow with Workspace ONE UEM

 Understanding Hybrid Azure AD Integration using Azure AD Connect

Figure: Azure AD Integration flow with Workspace ONE UEM

  1. The administrator configures the integration between Azure AD and Workspace ONE UEM.
  2. End-users begin one of the Azure AD-based onboarding flows. Based on the user's email/UPN, Azure AD retrieves the authentication endpoint (managed/federated) and redirects users to authenticate and provide MFA if configured.
  3. After the user is successfully authenticated, Azure AD sends the JWT token along with the Terms of Use and Enrollment URLs to the device.
  4. Device redirects to Workspace ONE UEM and enrollment restrictions are checked, if enabled. Workspace ONE UEM parses the JWT token to obtain Azure AD directory ID (TID), Object ID (OID), and the UPN for the user. Workspace ONE UEM uses these attributes to query Azure AD for the user’s attributes, including the Immutable ID if present.
  5. Workspace ONE UEM prompts for any optional enrollment prompts or terms of use if configured after a successful match.
  6. Azure AD sends Access Token to the device which is forwarded to Workspace ONE UEM. Workspace ONE UEM parses token and saves the device into the database, keeping track of the Azure AD Device ID.
  7. Lastly, Workspace ONE UEM performs any additional configured enrollment restrictions. If triggered the device is wiped, if not the device has successfully joined Azure AD and enrolled into Workspace ONE UEM.

Integrating Azure AD with Workspace ONE UEM

This exercise walks you through the procedures for configuring enrollment for both SaaS and On-Premises applications. Screenshots are from the Microsoft Azure tenant available at the time this document was written and may change as Microsoft updates portals.

Warning: Microsoft has made some recent under-the-hood changes to how the integration of Azure works with 3rd party MDMs.

If you are experiencing issues with the integration, check the following VMware KB:

VMware KB: UEM Integration with Azure AD On-Premises MDM App fails (86237) 

Microsoft Docs: Add your custom domain name using the Azure Active Directory portal

1. Enable Azure AD For Identity Services in Workspace ONE UEM

1.1. Log in to the Workspace ONE UEM Console

 Log in to the Workspace ONE UEM Console
  1. In the Workspace ONE UEM console login window, enter your user name and password.
  2. Click Log In.

1.4. Enable Azure AD For Identity Services

 Enable Azure AD For Identity Services
  1. Scroll down to the Advanced options.
  2. Click Use Azure AD For Identity Services.

1.5. Locate and copy the Workspace ONE URLs

 Locate and copy the Workspace ONE URLs
  1. In the organization group configured to enroll Windows desktop devices, copy the following:
    • MDM Enrollment URL 
    • Terms of Use URL
  2. Save the URLs to a text file.

2. Azure Active Directory Admin Console Configurations

2.1. Navigate to Azure Active Directory

 Navigate to Azure Active Directory
  1. Log in to the Microsoft Azure tenant, and in the navigation bar on the left, click Azure Active Directory.
  2. Click Mobility (MDM and MAM).
  3. Click Add application.
    Note: Make sure that you do not assign the same users to both Workspace ONE and other third-party MDM providers.

2.3. Add On-Prem Application (Workspace ONE UEM Dedicated SaaS and On-Premises Deployments using Custom Domain)

Note:  If you are using a *.awmdm.com or any VMware owned domain then only configure the AirWatch by VMware application (covered in the steps above), customers using custom domains will have to leverage the On-Premises MDM application and add your custom domain name using the Azure Active Directory portal.

Warning: Microsoft has made some recent under-the-hood changes to how the integration of Azure works with 3rd party MDMs.

If you are experiencing issues with the integration, check the following VMware KB:

VMware KB: UEM Integration with Azure AD On-Premises MDM App fails (86237) 

Microsoft Docs: Add your custom domain name using the Azure Active Directory portal

 Add an On-Premises Application

Click Add application.

 Select the On-Premises Application
  1. Select the On-premises MDM application.
  2. Click Add.
 Select the On-Premises Application

Click On-premises MDM application which was just added, to begin configuration.

2.4. Configure the On-Prem Application with Workspace ONE UEM Details

 Configure the On-Prem Application with Workspace ONE UEM Details
  1. Assign the proper MDM user scope. You can select All or Some and choose a group of users.
  2. Complete the following:
    • Paste your MDM Terms of Use URL from the Workspace ONE console into the MDM terms of use URL field in Azure.
    • Paste your MDM Enrollment URL from the Workspace ONE console into the MDM discovery URL field in Azure.
  3. Under Configure, click Save.
  4. Click On-premises MDM application settings.
 Configure the On-Prem Application with Workspace ONE UEM Details
  1. Click Expose an API.
  2. Click Edit next to Application ID URI.
 Configure the On-Prem Application with Workspace ONE UEM Details
  1. Enter your Device Services URL (hostname of the other URLs) into the Application ID URI text box. 
    • Example https://custom.domain
  2. Click Save

Note: Saving the settings works if you performed the prerequisite task of adding a custom domain name. If you see an error, check that you added your custom domain to Azure.

2.5. Confirm User has correct Azure Licenses Assigned

Navigate to Licenses

 Navigate to Licenses
  1. Click Azure Active Directory.
  2. Click Licenses.

Select Premium Licenses

 Select Premium Licenses
  1. Click All Products.
  2. Select the proper license (onboarding requires Azure AD Premium P1 or later, or any bundle which includes this license).

Assign Premium Licenses to Users

 Assign Premium Licenses
  1. Click Assign.
  2. Choose the users or groups to add, and click Assign.

Note: Assigning Licenses to Users can also be done directly in the M365 Admin Console as well.

3. Copy Azure Active Directory Tenant Properties

 Copy Azure Directory Data

Copy the Azure Active Directory Tenant Properties to enter into Workspace ONE UEM shortly.

  1. Click Properties.
  2. Under Tenant Properties, copy the Tenant Name. This will typically be a text field.
  3. Under Tenant Properties, copy the Tenant ID. This will generally be a long list of numbers.

4. Paste the Azure Details in Workspace ONE UEM

 Paste the Azure Details in Workspace ONE UEM

Return to the Workspace ONE UEM Console.

  1. Navigate back to System>Enterprise Integration>Directory Services and scroll down to Azure integration.
  2. Paste the copied Tenant ID from Azure into the Directory ID text box in Workspace ONE UEM.
  3. Paste the copied Tenant Name from Azure into the Tenant Name text box in Workspace ONE UEM.
  4. Update the Immutable ID Mapping Attribute if needed and Click Save
    • Specify the AD attribute Source Anchor in Azure AD Connect. The Source Anchor is mapped to the Immutable ID in Azure AD. Workspace ONE UEM uses this to assign devices to AD users during enrollment through Azure AD.

Note: By default, objectGUID is used for the Immutable ID Mapping Attribute.

However, this value will differ if the sourceAnchor attribute was changed when setting up Azure AD Connect or if using a third-party user source.

You must match the sourceAnchor attribute being sent to Azure AD with the Immutable ID Mapping Attribute in the Workspace ONE UEM console.

The most common attribute used after the default objectGUID is mS-DS-ConsistencyGuid. For more details about sourceAnchor attributes, see Azure AD Connect: Design Concepts.

Workspace ONE UEM On-Premises or Dedicated Saas Environments

1. Workspace ONE UEM On-Premises or Dedicated Saas Environments

In the majority of cases, you will use the AirWatch by VMware application in the Azure application gallery. This application includes all permission required for integration. 

The AirWatch by VMware application includes a list of Workspace ONE UEM SaaS Environments. Therefore, shared SaaS customers and dedicated SaaS customers without a custom domain should only leverage the AirWatch by VMware application.

If you have Workspace ONE UEM On-Premises or a Dedicated SaaS Environment with a custom domain, you would need to add the On-Premises MDM application. This is required to create trust between the Workspace ONE UEM instance and Azure AD.

To summarize, if you are using a *.awmdm.com or any VMware owned domain then only configure the AirWatch by VMware application, customers using custom domains will have to leverage the On-Premises MDM application and add your custom domain name using the Azure Active Directory portal.

Note: 

If you run into any issues while adding the AirWatch by VMware application and your Workspace ONE UEM environment is:

  • Shared SaaS or 
  • Dedicated SaaS without a custom domain

Please reach out to your VMware support representative.

Warning: If you are a SaaS customer who previously set up this integration using the On-Premises MDM application, then do NOT make any modifications as this will break your integration. For more information, refer to the following VMware KB: VMware KB: UEM Integration with Azure AD On-Premises MDM App fails (86237) 

Device Onboarding using Azure Active Directory

Register Device Hash for Windows Auto-pilot

Register Device Hash for Windows AutoPilot

Your Windows devices need to be pre-registered in the Microsoft Endpoint Manager admin center. This portal lists all devices for your organization so that you can assign an Autopilot profile. The easiest method is purchasing a device from participating OEM and they will automatically be added to your device portal.

If your OEM is not listed here or you have existing devices, it is still possible to get the required information to upload these devices to the Microsoft Endpoint Manager admin center manually or directly from a device for testing purposes. 

1. Boot Device into OOBE and Run PowerShell script

During the OOBE (Out of the Box Experience) you also can initiate the hardware hash upload by launching a command prompt (Shift+F10 or Shift Fn+F10 for Virtual instances), and entering the following commands.

Powershell.exe 
Install-Script -name Get-WindowsAutopilotInfo -Force
Set-ExecutionPolicy Unrestricted
Get-WindowsAutoPilotInfo -Online

Click to copy

run powershell script

2. Enter in Microsoft Endpoint Manager Credentials

At this point you will be prompted to sign in. Sign in with an account with the Intune Administrator Role, accepts the permissions as shown, and the device hash will then be uploaded automatically in Microsoft Endpoint Manager.

accept intune permissions

3. Confirm Device Registered in Microsoft Endpoint Manager

Navigate to https://endpoint.microsoft.com/#home  then Devices, Windows, Windows Enrollment, then Devices. Confirm your device serial number as registered and an AutoPilot Profile is Assigned.

This AutoPilot Profile contains configuration for the Out Of Box (OOBE) Experience.

confirm autopilot device registration

You can see the Device serial number from the Command Prompt session used to run the AutoPilot registration Script. You can also find the device serial number locally on the machine. Open Command Prompt and enter

wmic bios get serialnumber

Click to copy

device serial number

You have successfully configured Windows Autopilot to work with VMware Workspace ONE UEM and your Windows desktop device. The next step is to power on your Windows desktop device or virtual machine to see the benefits of streamlining the OOBE process for your end-users. Remember that the OOBE process will look different depending on the build version, keep this in mind when creating end-user documentation.

Enroll with Azure Autopilot (most common method)

What Is Autopilot?

Windows Autopilot is a capability from Microsoft that allows pre-configuration for Windows desktop devices in conjunction with the Out-Of-Box-Enrollment (OOBE) experience. One of the most significant capabilities is that you can directly ship a Windows desktop device to an end-user. As soon as it is powered on, it shows the user a customized login screen during OOBE requesting the user to enter their credentials. After successful authentication, the device is joined to Azure AD, automatically enrolled into Workspace ONE, and all the user's apps and configurations are automatically installed.

With every Autopilot deployment, devices do the following by default (you can create deployment profiles to customize additional options):

  • Skip OneDrive, and OEM registration setup pages
  • Automatically set up for work or school
  • Get a customized Sign-In experience with the company or school branding

You can use Windows Autopilot to simplify device enrollment, and to set up and pre-configure new devices for productive use, or to reset, re-purpose, or recover devices. You can avoid the need to build, maintain, and apply custom operating system images to the devices.

For more information from Microsoft, see Microsoft Docs: Manage Windows device deployment with Windows Autopilot Deployment.

Autopilot Prerequisites

Before you can perform the procedures in this exercise, verify that the following components are installed and configured:

  • A Windows 10 or 11 Professional, Enterprise, or Education device (physical or virtual) running version 1703 or later with internet access
  • Azure AD Premium P1 or P2
  • Azure AD integrated with Workspace ONE UEM (see Integrating Azure AD with Workspace ONE UEM section above)
  • Users must have permission to join devices to Azure AD
    • Check this in your Azure Portal at Azure Active Directory > Devices > Device Settings and allow everyone, no-one, or a specific group. You can also configure adding other administrator accounts to the device during Azure AD join here.
  • A functional Azure AD tenant and an Azure AD admin account that can log in to portal.azure.com

Dell, HP, and Lenovo are examples of Original Equipment Manufacturers (OEMs). When a new computer is purchased from an OEM, before the device leaves the OEM, the device has had several configuration tasks applied to it. These tasks include the initial installation of the Windows desktop Operating System (OS). Part of this process involves running an EXE file named Sysprep in Audit Mode. 

Audit Mode allows the OEM to install drivers, add applications, change windows settings, and generally get the PC ready to ship directly to an end-user. Understanding the details behind Sysprep and Audit Mode is beyond the scope of this tutorial. What a VMware Workspace ONE UEM Administrator needs to understand is that when a person takes the computer out of the box and powers on the device for the first time, Sysprep has just exited Audit Mode. Thus, the first thing the end-user is going to see on the device is a series of questions from Microsoft that are designed to finish the configuration of the computer. Microsoft named the Q&A section of the Windows Setup process the Out of Box Experience (OOBE). The purpose of Windows Autopilot is to reduce the number of questions the end-user is asked during OOBE by letting the IT Administrator pre-answer some of the questions.

The exact number of questions seen by the end-user during OOBE varies per OEM. Each OEM can choose to add more questions to the list based on the services they are providing with the computer. The specific version of Windows also plays a factor in which questions are presented. The total number of questions seen by the end-user also varies based on if the user already has existing Windows desktop devices. It also varies based on how Windows Hello is configured. Regardless of the total number of questions asked, we can all agree that the fewer questions an end-user must answer to start using Windows, the better the experience will be for everyone.

The Windows installation generates a unique hardware identifier. For Autopilot to start, the hardware identifier must be registered with Microsoft. Each OEM has a different process to handle this for all new hardware purchases made directly with the OEM. If a new computer is purchased from a retail store, or the IT admin is using virtual machines, then the IT administrator is responsible for registering these systems with Microsoft. This tutorial covers how to register a single device

Enroll using Azure Out-of-Box-Experience

This enrollment option is used primarily for new company-owned devices that are not domain-joined and is triggered the first time end-user power on a device. The user joins the device to the Azure cloud domain as part of the initial setup process. This workflow does not require end-users to have admin privileges.

Note: If you are leveraging Microsoft Windows Autopilot, the end-user configuration is simplified and streamlined, but requires having the original equipment manufacturer (OEM) of your device preregister these devices with Microsoft.

When end users power on a device for the first time, they respond to the following device prompts:

  1. Enter corporate credentials.
  2. Set up multi-factor authentication.

    Note: In most cases, end users are prompted to provide a phone number for a call or text. However, Windows Hello for Business provides more advanced options, such as facial recognition, retinal scanning, or creating a unique PIN.

Devices then join the Azure cloud domain, and register with VMware Workspace ONE UEM for management.

Enroll using Azure AD Join or Enroll with Office Applications (BYOD)

Enroll using Azure AD Join

This enrollment option is triggered from the device settings. Also referred to as cloud-domain join, this workflow is typically used for existing company-owned devices that are not already joined to an on-premises domain. End users must have admin privileges and use their corporate credentials to join the device to the Azure cloud domain.

  1. From System Settings, users complete the following tasks:
    1. Enter corporate credentials.
    2. First-time Azure account users are prompted to provide a phone number for account recovery.
    3. Register for Windows Hello for Business by creating a unique PIN.
      Note: Configure a Passport for Work profile to specify this PIN’s complexity.
  2. Devices join the Azure cloud domain, and register with Workspace ONE UEM for management.

Enroll with Office Applications

This enrollment option is primarily used for existing company-owned or personal-owned devices that are not domain-joined, and is triggered when end users open a Microsoft Office app for the first time. End users must have admin privileges, and connect their Azure accounts to the device. Use this workflow if you already have Azure AD Premium licenses and do not want to join the device to the Azure cloud domain.

  1. End users open a Universal Windows Platform version of any Office 365 app, which connects their Azure account to the device.
  2. Enrollment begins.

Summary and Additional Resources

Conclusion

This tutorial introduces you to the device enrollment functionality of Workspace ONE UEM, and explains how to use this functionality to enroll Windows 10 devices. A set of exercises describe the process of configuring the Microsoft Azure onboarding method, including the procedures for configuring enrollment for both SaaS and On-Premises applications, and how to select the best enrollment option to meet your business needs. The end result is your ability to manage the Windows 10 device enrollment through the Azure AD.

Additional Resources

Changelog

The following updates were made to this guide:

Date Change
2022/07/22
  • Re-organised sections. Clarified information around integration methods. removed some old content.
2022/01/31
  • Updated instructions for when to add AirWatch by VMware versus the On-Premises MDM application in Azure Active Directory. Refer to the following VMware KB to see why changes were required: https://kb.vmware.com/s/article/86237
2021/10/20
  • Updated terminology and general grammar 
2021/07/30
  • Added section on AirWatch by VMware app

Feedback

Your feedback is valuable. 

To comment on this tutorial, contact VMware End-User-Computing Technical Marketing at euc_tech_content_feedback@vmware.com.

About the Authors

This tutorial was written by:

  • Darren Weatherly, Senior Architect, End-User-Computing Technical Marketing, VMware
  • Hannah Jernigan, Technical Marketing Manager, End-User-Computing Technical Marketing, VMware

Considerable contributions were made by the following subject matter experts:

  • Saurabh Jhunjhunwala, EUC Customer Success Architect, VMware
  • Bryan Garmon, Sr. Solutions Engineer, End-User-Computing, VMware 

Associated Content

home-carousel-icon From the action bar MORE button.

Filter Tags

Workspace ONE Workspace ONE UEM Document Operational Tutorial Advanced Win10 and Windows Desktop Deploy Business Continuity Modern Management