Blog Post

Intune - Microsoft Surface Device Configuration Firmware Interface Profiles

D Walsham • Apr 23, 2021

Control your Surface Device UEFI Settings for Modern Workplace Management

Introduction

When it comes to preparation within Modern Workplace Management whether you are already fully in Intune or in the mist of moving other from an on-premise/co-management solution to Intune, one of the key things around this transition is the current process in which you use to prepare and build your actual endpoints.

As of most recent of times a lot of us in a real case scenario are utilising UEFI (Unified Extensible Firmware Interface) enablement when it comes to secure booting as well as controlling which internal devices are enabled and much more.

Now when it comes to these settings within the BIOS (though UEFI is on its way to replacing this) though we can automate some of this on an OS level, most of this has been incorporated within a manual process or task list whether this is a pre or post build methodology.

And this is exactly where the DCFI Configuration comes in.

What is DCFI

So DCFI is the Device Configuration Firmware Interface which can be used as a configuration profile to control the following settings;

  • Whether the User can control UEFI Settings
  • Enable CPU/IO Virtualization
  • Set secure booting options
  • Enable/Disable internal hardware
So this profile can potentially takeover/remove those exact same manual tasks which we would normally have to do ourselves, or lucky enough to be utilising either an SCCM package or an Intune application to perform.

Compatibility of DCFI

Currently DCFI is only really made available for Surface Devices.

The current list is of reference to https://docs.microsoft.com/en-us/surface/surface-manage-dfci-guide

  • Surface Pro 7+
  • Surface Pro 7
  • Surface Pro X
  • Surface Laptop 3
  • Surface Book 3
  • Surface Laptop Go
  • Surface Laptop 4

Prerequisites

Auto Pilot & Enrollment Status Page

In order to use this profile effectively you will need to use an Auto Pilot configuration profile first and also have your enrolment status page.

You will find if try to create this profile as standalone it may not work, and as this can be applied immediately through the enrolment status page, as soon as your device is ready to go you can double check your device by restarting and booting into the BIOS

( Note: This normally works by holding the volume up button whilst rebooting for surface devices)

Settings Walk through

Allow local user to change UEFI Settings

So this particular setting I decided to create a section for it on its own. Reason being is because if we were using lets say a BIOS password to lock down a normal user from accessing the BIOS/UEFI Settings then this setting will simply override it as this will stop any user from changing any settings if set to None for example.

You can however change the setting so that you can allow users to change any setting which is not configured by this profile but it will be your discretion if this is the correct way to proceed.

Boot Options

For those who are still using PXE for task sequence deployment via Co-Managed topology these settings would appeal as you can use this profile to set the secure boot settings for your endpoints.

How to Configure a DCFI ProfileHow to Configure a DCFI Profile

To configure the configuration profile please perform the following;

  1. Log into your Device Management Console
  2. Go to Devices
  3. Select Windows
  4. Select Configuration Profiles
  5. Click to Create Profile
  6. For the platform select " Windows 10 or Later " and select profile type as " Template "
  7. Find the setting which says "Device Configuration Firmware Interface" then click next.
  8. Create a name for your profile and relevant description then click next.
  9. Select the settings which you require then click next.
  10. Select the group which you will assign the profile to then click next.
  11. Set the Applicable rules which the profile will run against and finish the profile creation.

by D Walsham 13 Dec, 2021
Looking through the current SQL Server topology and how it affects our decision
by D Walsham 07 Oct, 2021
Introduction
by D Walsham 06 Oct, 2021
Introduction
by D Walsham 12 Aug, 2021
All the parts of the series we went into great detail about how we analyse an end to end solution and how we would design a solution in which would allow us to build endpoints without SCCM being a dependency. Whilst we did this, there is another scenario which we have not touched on yet, which is the hybrid scenarios. In a perfect world ideally you would have your Azure Active Directory within the cloud, every machine meets the recommended requirements for Windows 10, everything is imported into Intune/Autopilot and everyone is happy. But we know this isn't realistic in all cases. Many organisations cannot just simply up and go from on-premise into the cloud therefore the checkpoint here is of course getting into hybrid solutions such as; Co-Management Between Intune and SCCM Hybrid AD with Azure AD and On-Premise AD syncing together These things can play a very interesting part in how you would tackle this if you envisage the next step in the blueprint is to be in a position in which you can build and manage endpoints soley within Intune. With this final part of the series we will go in-depth in how the common hybrid setups look like and how we go about moving into the next step of being able to manage and build devices without SCCM.
by D Walsham 29 Jul, 2021
In continuation from the previous part where we had discussed how we create the "on site" piece of the solution, this was the part which would allow us to get our endpoints into a state in which they would essentially be ready to go through the Autopilot process. Which leaves our next piece of the puzzle, to begin the configuration of the actual backend side that resides within our Endpoint Management console. And you will see how everything ties up together to satisfy the full end to end process of getting an unknown (or known) device to proceed thorough the whole workflow to be finally managed by Intune without the aid of SCCM taking part in any of the prerequisites or preparation at hand.
by D Walsham 15 Jul, 2021
In this part we are now going to look into the technical step by step points on how we put everything together. In the previous part we spoke about the structure of how we would asses whether a machine was actually ready to be built with Autopilot or not with a build checklist process which would step through all areas which would cover an endpoints eligibility. Now with everything planned out we finally want to step into making things reality by putting everything together.
by D Walsham 02 Jul, 2021
When it comes to managing your endpoints in endpoint manager, one of the things you may be looking to do is to get all of your Intune registered machines to also be enrolled as Autopilot devices. Now we can of course just have the deployment profile deployed to all machines and then hit the "Convert targeted machines to autopilot" but this might not necessarily be feasible for every client. We may want to perform some due diligence first so we can at least understand what devices in Intune are not in Autopilot.
Show More
Share by: