MS Autopilot with Shibboleth

[Daniel Lutz]

Hi Matt

(A bit late, but maybe useful.)

Matt Brennan via users schrieb/wrote (30.10.24 16:04):
> All the posts I'm finding agree, but they're also all several years old. 

We once found this page, which seems to be newer. I have the impression
that it's some response of Microsoft to the increasing demand of universities
for support of federated login via SAML.

   Configure federated sign-in for Windows devices
   https://learn.microsoft.com/en-us/education/windows/federated-sign-in

To my understanding, this supports device-login via an external SAML IdP,
but for dedicated Windows licenses for education only.

I'm not sure about this notice:

   Important
   
   WS-Fed is the only supported federated protocol to join a device to
   Microsoft Entra ID. If you have a SAML 2.0 IdP, it's recommended
   to complete the Microsoft Entra join process using one of the following
   methods:
     - Provisioning packages (PPKG)
     - Windows Autopilot self-deploying mode

To my understanding, a SAML 2.0 IdP is supported if using either PPKG or Windows Autopilot.
(But as mentioned, it seems to be limited to Windows 10/11 Education licenses.)

We haven't tested this ourselves, though. You might have a look at it.


Daniel