Autopilot enrollment with Firstbase

Service Overview

Firstbase supports customers in ensuring devices are appropriately added to their Entra/Azure tenants. Microsoft restricts AutoPilot enrollment to the country/region where the customer’s Entra Tenant was created so this is accomplished either by directly adding devices to the customer’s tenant in the country where the Entra/Azure tenant was created or by sharing extracted device Hash IDs with the customer for manual upload. Firstbase will provide extracted Hash IDs to enable customers to manually register devices in their Entra Tenants.

Firstbase suppliers and distributors extract Hash IDs for all net-new devices purchased through Firstbase.

Fees for Autopilot Enrollment and Hash ID Extraction:

• For both Autopilot enrollment and Hash ID extraction, fees are built into the device/hardware pricing provided by Firstbase to the customer. 
• If Firstbase extracts hardware Hash IDs from devices at a Firstbase warehouse, customers will be charged a fee. This service is only available in select countries.

Autopilot Enrollment: Firstbase Registers Devices on Customer’s Behalf

Firstbase will enroll devices into a customer’s Entra/Azure tenant on their behalf using Microsoft’s OEM authorization model for Autopilot registration.

To facilitate this, Firstbase coordinates with the customer and its network of approved suppliers, distributors, and select OEMs to initiate the necessary authorization process. The authorization links provided to customers originate from these regional partners—not directly from Firstbase. Throughout this process, Firstbase provides full support and guidance to ensure devices are successfully registered and ready for deployment.

Process:

1. Customer Invitation Approval:
   • During the onboarding phase—prior to placing any orders—customers will receive an authorization invitation from a local distributor or select OEM (e.g., Dell) as part of the regional project setup. Firstbase will share these authorization links via email and coordinate the process. While the links are issued by our partners, Firstbase facilitates the exchange and provides support throughout.
   • The customer must accept this invitation, allowing Firstbase partners to register devices directly into their Entra tenant.
2. Device Enrollment:
   • Once approved, Firstbase with the assistance from local suppliers will enroll new devices directly into the customer’s tenant using Microsoft’s Autopilot service.
   • Devices will be pre-configured with Autopilot profiles according to the customer’s policies.
3. Verification and Deployment:
   • Customers can review enrolled devices within their Windows Autopilot devices in Microsoft Intune.
   • Upon deployment, devices will automatically enroll in Microsoft Intune and apply company configurations.

This method simplifies device provisioning and ensures seamless out-of-the-box enrollment for new devices.

Manual Enrollment: Hardware Hash ID Extraction and Upload

In countries where Firstbase cannot directly enroll devices, Firstbase provides extracted Hash IDs for manual upload. Hardware hash IDs can only be extracted from the physical device. As a result, Firstbase coordinates with local suppliers and value-added resellers (VARs), who first receive the devices into their warehouses. These partners extract the hardware hash IDs and hold the devices until enrollment is confirmed.

This hold-and-confirm process applies to all Firstbase device procurement—whether it is an inventory order or drop-ship order—and ensures enrollment is complete before devices are shipped to end users, avoiding failed enrollments, device recollection, or customer-led troubleshooting post-delivery.

Process:

1. Extracting and Sharing Hash IDs:
   • The supplier extracts and shares the hash ID CSV file with Firstbase.
   • The assigned Firstbase Operations Success Manager (OSM) then shares the CSV file with the customer, typically via email. Customers may request a more secure method of file delivery (such as secure file share), but use of such methods is subject to Firstbase approval.
   • The OSM follows up to confirm that the customer has successfully uploaded the devices into their Entra/Azure tenant using the provided CSV file. Once confirmation is received, the OSM or OSA instructs the supplier to release and ship the devices to the end users.
   • The extracted hash data is formatted into a CSV file, containing:
     • Device Serial Number
     • Windows Product ID
     • Hardware Hash
2. Customer receives Hash IDs and uploads them to Windows Autopilot in Microsoft Intune:
   • Sign into Microsoft Intune Admin Center: Microsoft Endpoint Manager.
   • Navigate to Device Enrollment:
     • Select Devices in the left-hand pane.
     • Under By platform, select Windows.
     • Under Device onboarding, select Enrollment.
     • Under Windows Autopilot, select Devices.
   • Import Device CSV:
     • In the Windows Autopilot devices screen, select Import.
     • Select the CSV file provided by Firstbase.
     • Select Import to start uploading the device information (this may take a few minutes).
   • Sync Devices:
     • In the Windows Autopilot devices screen, select Sync.
     • A message will indicate that synchronization is in progress.
     • Select Refresh periodically until the new devices appear.

Important Consideration for Hardware Hash ID Enrollment:

Devices must have their Hash IDs added to a customer’s tenant before they are powered on by an end user. If not, the device cannot be enrolled in Autopilot without a full reset, which may cause onboarding delays or incur additional logistical cost to exchange the device.

For more details, refer to Microsoft’s official documentation: Add Devices to Windows Autopilot.