DEP and multiple enrollment profiles

[powellbc]

We are imminently going to be deploying DEP in our environment, and we deal with a lot of distributed IT support who cannot or won't engage in the process. For this reason we need to set up a default PreStage enrollment for those areas not creating their own.

I see the "Automatically assign new devices" check box which seems like it would be appropriate for this default PreStage enrollment profile, but how would this work when an area has a more specialized PreStage enrollment and a computer is in scope of both profiles? Do the settings merge, or is it a scenarios like network segments where the smaller scoped group "wins"? We want to make sure that those what want to use of more of the DEP functionality can.

[yan1212]

Hi @powellbc

The answer to your question is that a computer can only be assigned to a single PreStage enrolment - unlike a policy or configuration profile.

In your scenario, you can have a default PreStage where all devices are assigned automatically but you'd have to manually move devices out of that default PreStage and into the other specialised ones.

Hope this helps

[powellbc]

Thanks for the insight. I was thinking in this case we can set up a default pre-stage enrollment and apply it to all computers, with groups for more specialized profiles set as exclusions. However, when I went to scoping I saw how scoping for this is different than policies.

Any ideas how to tackle this? Do we need to use "Automatically assign all new devices to this PreStage enrollment" and then remove them from one and add them to the other pre-stage?

[bburdeaux]

Whether or not to automatically assign devices is dependent on whether assigning devices to non-default prestages is more or less common than assigning devices to the default prestage. Basically, would it be more time efficient/convenient to move exceptions out of the auto-assigned prestage and into the correct one, or to not auto assign anything and manually assign everything. Also, you can dynamically enable or disable the automatic assignment on whatever prestage you wish. For example, we currently don't use any auto assignment, as the devices coming in are mostly either small batches or repairs, which typically get scattered across the various prestages, but will enable auto assignment when we make a large purchase of devices we know will all or mostly go to the same prestage.

There is currently no scoping for prestages, but there are feature requests for it. This is mostly due to the lack of available information. Since the prestage has to be applied before enrollment, the only information the JSS can get about the device is Serial Number, Model and Description as provided by DEP.