Intel® vPro®: How to remotely provision an endpoint

A customer is looking for an option to provision an Intel® vPro® endpoint remotely and wants to understand which Intel tools can be used, what prerequisites are required, and whether provisioning is possible when the endpoint is outside the corporate network.

Intel offers the following remote management solutions for Intel® vPro® platform endpoints:
• Intel® Endpoint Management Assistant (Intel® EMA): software used to configure and manage Intel® AMT-capable endpoints in hosted or cloud-based environments.
• Intel® vPro® Fleet Services: Intel-hosted Software as a Service (SaaS) used to activate and manage Intel® vPro® technology.

Remote provisioning requirements
1. The endpoint must be supported by Intel® vPro® technology and Intel® AMT.
2. The endpoint must be able to communicate with the provisioning service or management server.
3. For Admin Control Mode provisioning using an Intel® AMT provisioning certificate, the certificate domain must match the endpoint DNS suffix used during provisioning.

For wired provisioning, this DNS suffix is typically provided by DHCP Option 15 and must match the domain portion of the Intel® AMT provisioning certificate. If DHCP Option 15 cannot be used, the Intel® AMT provisioning certificate domain can be added manually to the PKI DNS Suffix field in Intel® Management Engine BIOS Extension (Intel® MEBX).

Provisioning options
• Corporate network provisioning: Provision the endpoint while it is connected to the corporate network, where the DHCP Option 15 domain matches the Intel® AMT provisioning certificate domain.
• MEBX PKI DNS suffix provisioning: If the endpoint is not using a matching DHCP Option 15 domain, manually add the certificate domain in the PKI DNS Suffix section of Intel® MEBX on the endpoint.

Important:

For Intel® EMA and Intel® vPro® Fleet Services, remote provisioning outside the corporate network without prior configuration, physical endpoint access, or an already matching provisioning environment is not available at this time.
Intel® AMT provisioning certificate is optional; third-party charges are necessary.