Autopilot hardware hash import
Registering existing devices into Intune Autopilot without touching each one
Overview
Onboarding an existing estate into Autopilot normally means visiting each machine, running a hash extraction by hand, and uploading a CSV. This does the same thing from a deployment tool instead.
The problem
Getting hundreds of already-deployed devices into Autopilot is the slow part of an Intune migration. The documented path is a per-device command line, a CSV per batch, and a portal import that fails on one bad row without saying which.
How it works
The script runs as System, reads the 4,000 byte hardware hash from WMI along with the OA3 product key, requests a short-lived Graph token using certificate based app authentication, and registers the device with its group tag already set.
Design decisions
- It checks whether the device is already registered before writing, so a re-run does not produce a Graph conflict.
- Authentication uses a certificate rather than a client secret sitting in the script.
- Setting the group tag at registration means dynamic Entra ID group membership applies straight away.