Get-AutopilotDeviceAssociation

Author(s)

• Rudy Ooms

Tags

Windows Autopilot Intune DeviceAssociation DeviceLink Autopilot-Device-Preparation OOBE

Functions

Resolve-DLRequestedAction Add-DLRedaction Protect-DLText Protect-DLObject Get-DLSha256 Get-DLAuthenticationMethod Initialize-DLLogging Write-DLLog Write-DLVerboseLog Get-DLActionPlan Initialize-DLStepPlan Invoke-DLStep ConvertTo-DLHeaders ConvertTo-DLBodyLog Get-DLHttpFailure Save-DLHttpRecord Invoke-DLRestMethod Write-DLExportSummary Invoke-DLExport Invoke-DLLink Initialize-DLFirmwareInterop Get-DLFirmwareVariable Clear-DLFirmwareVariable Get-DLFirmwareRawValue Get-DLFirmwareAssociationState Remove-DLFirmwareAssociation Get-BlobFromCsv Resolve-Csv Get-DLDelegatedGraphScopes Get-DLInteractiveGraphToken Get-GraphToken U Invoke-Inspect BI Graph-Headers Get-DLIdentifierHash ConvertTo-DLNormalizedUuid Get-DLLocalDeviceIdentity Test-DLAssociationRecordMatch Assert-DLCloudRemovalParameters Resolve-DLCloudAssociation Invoke-DLCloudAssociationDelete Wait-DLCloudAssociationDeletion Wait-PreAssociated Invoke-Upload Show-LinkResult ConvertFrom-DLBase64Url Get-DLStringFromBytes Get-DLGuidCandidates Expand-DLDeviceLinkJwt Get-DLJsonQuietly Resolve-DLTokenSigningKeys Test-DLJwtSignature Invoke-DLValidateAssociationToken New-DLCheck Test-DLVirtualMachine Test-DLDeviceRequirements Write-DLRequirementsReport Invoke-DLRequirementsPreflight

Dependencies

This script has no dependencies.

Release Notes

Version 1.5.0 adds -Action CheckRequirements, which verifies the Microsoft-documented Device Association requirements: physical device (not a VM), 64-bit Windows 11 client, a supported build (24H2 26100.9278 or 25H2 26200.9278, KB5120998 or later), a supported edition, TPM 2.0 enabled and not in Reduced Functionality Mode, UEFI firmware, and whether the TPM has been refusing to create the DEVICEASSOCIATION_TACK_RSA key. Adding -Online also tests the required ztd.dds.microsoft.com and attest.azure.net endpoints. The device-side actions now run the same check as a non-blocking preflight and warn when the device does not qualify.
Version 1.4.0 adds -Action ReadAssociation -Validate: it decompresses DeviceLinkJwtCompressed, checks the token is a well-formed RS256 JWT, still inside its iat/exp window, has a linkId matching the DeviceLinkId UEFI variable, and (with -TenantId) a matching tenant and device inventory. Adding -Online resolves the issuer's published signing key and verifies the RS256 signature. Only booleans, timestamps and the signing-key thumbprint are printed or logged, unless -ShowClaims is added, which also prints the decoded JOSE header and payload to the console (console only; never to the diagnostic files).
Version 1.3.0 renames the script and published command to Get-AutopilotDeviceAssociation and adds a .DESCRIPTION block for PowerShell Gallery publishing. Export, Inspect, Upload, Discover, Link, ReadAssociation and RemoveAssociation behaviour is unchanged; the console banner, work folder and diagnostic file names are unchanged.
Version 1.2.0 keeps the normal console concise, moves diagnostic events to -Verbose, and selects the first returned Device Preparation policy when no policy ID or name is supplied.