New validation path for APv2

[Majo-pdc]

There is currently no option for APv2 enrollment / validation without pre-registrering your device in Intune.

Both "Enable Coporate Indentifier Validation" and "Enable Device Association Validation" requires pre-registration of devices, which defeats the main purpose of APv2.

[Majo-pdc]

Also, thank you for creating such as great tool!

[okieselbach]

Fair point. Microsoft only requires corporate identifiers or device association for APv2 when personal enrollments are blocked, and device association is designed to be done by the OEM/reseller rather than by IT. For tenants that deliberately allow personal enrollment, we're evaluating an opt-in mode: the agent's Intune MDM certificate is already mutually authenticated and bound to your tenant, so we'd verify it against your Intune inventory (Entra-joined devices only, optionally limited to your APv2 device group) instead of a pre-registered serial. Our recommendation stays the same: block personal enrollment and use corporate identifiers or device association.

[okieselbach]

You will find now a new option under Autopilot Validation "Enable Intune Enrollment Validation". It needs an additional graph permission you can set but then you can check for the Intune device as validation. So, your initial request is possible now. if you combine it with the other options, we have even stronger validation because we validate a pre-registration and the managed device object.

Let's give it a try and report back if something does not work out for you.