Skip to main content
Automating Entra ID and Intune provisioning with Tanium Tech Talks #144 video thumbnail
Module Deep Dive

Automating Entra ID and Intune provisioning with Tanium - Tanium Tech Talks #144

When the end of Windows 10 is pushing organizations toward Entra ID and Intune, Tanium's Rob Broughall breaks down exactly how Tanium Provision handles cloud enrollment—and why the method you choose has lasting implications for device readiness, agent deployment, and operational efficiency.

The shift from on-premises Active Directory to Microsoft Entra ID and Intune is accelerating, and the Windows 10 end of life has made that transition more urgent for organizations managing large Windows device fleets.

Provisioning devices into the cloud is more than just installing Windows 11—it means joining devices to the right identity service, deploying the Tanium agent automatically, applying policies, and ensuring the device is fully managed before it ever reaches an end user. Tanium Provision is built to handle exactly this, and the integration with Entra ID and Intune introduces a set of configuration choices that every team planning a Windows 11 migration needs to understand.

Rob walks through two distinct approaches to Entra ID enrollment within Tanium Provision:

  1. Using Windows Configuration Designer to generate a provisioning package
  2. Using an Autopilot configuration file

Each method produces a different outcome in terms of when the device appears in Intune, whether the Tanium agent is installed during the build, and whether custom scripts run at the end of provisioning. These are not minor differences; they affect time to value, operational overhead, and how you handle device personas across your organization.

Rob also covers the specific trade-offs that should drive your design decision, including token expiration, .zip file structure requirements, and where to look when something goes wrong.

If your team is evaluating how to modernize device provisioning as part of a Windows 11 rollout, this walkthrough gives you the technical detail you need to make an informed choice. Watch the full demo in the video below.

Key takeaways

  • Provision covers the full device lifecycle: Tanium Provision handles everything from installing an operating system and joining a device to Active Directory or Entra ID, to deploying the Tanium agent automatically, applying policies like BitLocker, and managing device retirement, including wiping and data removal.
  • Two supported paths to Entra ID enrollment: Tanium Provision supports two methods for enrolling Windows devices into Entra ID and Intune: Windows Configuration Designer (WCD), which generates a provisioning package (PPKG), and an Autopilot configuration file approach, each with distinct behavior and trade-offs.
“The Autopilot approach does not install the Tanium client, and it does not run the custom scripts that you can use as part of your bundle.”
Tanium Domain Architect Rob Broughall
  • WCD approach enrolls the device before first login: The PPKG created by Windows Configuration Designer contains a bulk enrollment token valid for up to six months; the device is already enrolled in Entra ID and Intune, and the Tanium agent is already installed, before any user logs in for the first time.
  • Autopilot enrollment happens at first login: With the Autopilot approach, the device does not exist in Entra ID or Intune until the user enters credentials at first login; the Tanium client must then be deployed via Intune, and custom scripts do not run as part of the build.
  • Token management vs. no expiration: The WCD provisioning package expires after six months and must be regenerated and re-uploaded to the bundle; the Autopilot JSON file contains no token or credential and does not expire, though it should still be handled responsibly.
“I must admit the conversations I have had with customers and prospects about exactly that, they tend to like the Windows Configuration Designer approach because it's actually seen as simplifying it because you're not reliant on the device being enrolled by the end user. That adds a layer of complexity that the WCD token removes.”
Tanium Domain Architect Rob Broughall
  • Design choice depends on use case: The WCD approach is well-suited for virtual devices and scenarios like retail point-of-sale terminals where having the device fully enrolled and managed before first login matters; the Autopilot approach may be more appropriate for internet-based deployments or corporate devices where the user credential step is acceptable.
“If you're thinking about time to value in terms of how long does it take from starting the process to the end user who's got a usable device, that's probably a really big argument in favor of going with the Configuration Designer token approach.”
Tanium Domain Architect Rob Broughall
  • Troubleshooting common configuration mistakes: Key issues to watch for include incorrect .zip file structure when packaging custom scripts (Provision expects files at the root of the .zip, not inside a subfolder), uploading the Autopilot JSON directly to the bundle rather than zipping it, and checking the Provision PE log in the Tanium client logs directory for PPKG import errors and exit codes.

Additional resources