Is there a way to join a Windows 10 computer to Azure AD using PowerShell?

Question

I want to join computers in my organization to Azure AD using a PowerShell script.

I tried using the New-AzureADDevice command

But in the example:

New-AzureADDevice -AccountEnabled $true -DisplayName "My new device" -AlternativeSecurityIds $altsecid -DeviceId $guid -DeviceOSType "OS/2" -DeviceOSVersion "9.3"

can someone explain where parameter AlternativeSecurityIds comes from?

have a look at this: jairocadena.com/2016/02/01/… quote from this blog post "AlternativeSecurityIds contains the certificate thumbprint with a specific scheme format (i.e. “X509:<SHA1-TP-PUBKEY>:” + thumbprint). This is how Azure AD will find the device object when the device presents the certificate upon authentication." — Guenther Schmitz
– Guenther Schmitz, Commented Sep 28, 2020 at 6:52
I think it is the 'key' you provided in Create device. learn.microsoft.com/en-us/graph/api/… — Carl Zhao
– Carl Zhao, Commented Sep 28, 2020 at 7:39

Satya V · Accepted Answer · 2020-09-28 10:15:02Z

AlternativeSecurityId which consists of three elements whereby only two would be needed for devices.

Reference : https://learn.microsoft.com/en-us/graph/api/resources/alternativesecurityid?view=graph-rest-1.0

AlternativeSecurityIds        : {class AlternativeSecurityId {
                                  IdentityProvider:
                                  Key: System.Byte[]
                                  Type: 2
                                }
                                }

Key itself is of type described here

X509:[thumbprint]+[publickeyhash]

Type determines the purpose of the key (eg Bitlocker, Windows Hello,Recoverykeys)

     $key = [System.Text.Encoding]::Unicode.GetBytes("X509:<SHA1-TP-PUBKEY><Thumbprint>")
     $altsecids = New-Object -TypeName PSObject -Property @{

     #'IdentityProvider' = 'null'
     'Key' = $key
     'Type' = "2" }




     New-AzureADDevice -AccountEnabled $true -DisplayName '<NAME>' -DeviceOSType 'OS/2' -DeviceOSVersion '9.3' -AlternativeSecurityIds $altsecids -DeviceId (New-Guid)

This is mostly used for internal use and my understanding you will not able to achieve your requirement.

Currently, there is no powershell script/commandlet that can auto join with AAD

There is already an existing Uservoice for the same.

The other option would be able to make use of :

Group Policy , OOBE, bulk enrollment and Autopilot

Collectives™ on Stack Overflow

Is there a way to join a Windows 10 computer to Azure AD using PowerShell?

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related