Automating Windows VM Enrollment in Intune with Declarative Deployment

Starting with Parallels Desktop 26.2, administrators can use Declarative Deployment to provision Intune-enrolled VMs without preparing or maintaining a full system image. This method supports embedding provisioning packages into both standard Microsoft Enterprise ISOs and custom-created ISOs, enabling a more streamlined and scalable deployment workflow.

Declarative Deployment significantly reduces operational complexity by eliminating the need for Sysprep and full VM image preparation. You only need a configuration package, which lowers deployment size and removes dependency on storage or CDN infrastructure for hosting large VM images. Once Windows is enrolled in Intune, you can deploy applications, enforce policies, and configure security settings using existing device management workflows.

Refer to the video and steps below for the basic configuration required to use this deployment option in the example of Microsoft Enterprise ISO: 

Prerequisites

1. A Windows host machine or VM to prepare a provisioning package.  

2. An active Microsoft subscription that supports device enrollment and management, with sufficient administrative permissions.

3. Parallels Desktop Enterprise Edition license.

Creating Provisioning package:

Creating an applying Golden image policy:

Prepare a provisioning profile

1. Install Windows Configuration Designer from the Microsoft Store or download it directly from the Microsoft website. 
2. Once it is installed, launch it and create a new project following the Provision desktop devices template.
3. Once the project is created, you’ll see the following page. In this step, you need to choose a name convention.

4. Once done, click Next and switch to the Set up network tab. Then you need to switch off the setup network toggle and click Next, proceeding to the Account Management page
5. The following step is important: Select Enroll in Azure AD and obtain a bulk token. Here, you need to sign in with your Microsoft Azure credentials.

Once you’ve successfully signed in, you’ll see the message confirming the successful receipt of the token.

5. Click Next. Feel free to skip the remaining steps by clicking Next on each one of them. 
6. In the final step, double-check your configuration summary and ensure everything is correct.

7. Click Create and memorize the path to the package file. 

Adding a provisioning package to your Golden Image and assigning it to a policy.

Configure the Golden Image

1. Log in to the Parallels My Account portal and navigate to the Parallels Management Portal.

2. Click on the Golden Images tab and select Add.

3. General Info: Enter a Name (e.g., "Win11 Enterprise + Intune") and Description.

4. Deployment Method: Select Declarative.

5. Provisioning Package: Under the Provisioning packge section, upload your .ppkg file (if <100KB) or provide a direct URL to the package.

6. Click Add to save the Golden Image.
   
   
   Note: "Install Options" controls whether you wish to also apply OOBE settings from your host Mac(language\region etc) and create a local account on the virtual machine. If you dont wish to have an account or use those settings, simply omit the options. Provisioning package will already skip OOBE and if needed can also create a local account with different credentials. 
   If you tick "Create local user account" deployment will end in Windows VM booting logged into that account having admin rights, otherwise installation will prompt for organization account login.

7. Navigate to the Policies tab.

8. Click Add to create a new policy (or click the specific policy name to edit an existing one).

9. General Information: Name the policy (e.g., "Department policy").

10. Policy applies to: Select the target User Group (License Key) this policy should apply to.

    Note: A license key/group can only have one active policy. 
    

11. Golden Image: In the Golden Image tab, select the image created earlier in the dropdown.

12. Settings: Configure any additional security options (e.g., Block USB, Disable Shared Folders) as required and click Next.

13. Click Add.

Run the installation on the user endpoint.

• Install Parallels Desktop and activate it using the provided key (or sign in via SSO if configured).

• Download: Upon activation, Parallels Desktop detects the assigned policy. A dialog will automatically prompt the user to download the Corporate VM

• Provisioning: Once downloaded, the VM starts, and the .ppkg is automatically applied during the first run (OOBE), configuring the OS and enrolling it in management (e.g., Intune) without user intervention, only prompting to login into corporate account: