Stage 2: Golden Image & Provisioning Package Preparation

What this stage accomplishes

Prepares whatever Stage 3's Golden Image record will point to: either a VM image you build yourself, or nothing at all if you're going Declarative — plus the Intune provisioning package, if your Windows VMs need to enroll.

Prerequisites

Stage 1 done (you need a sublicense/group to eventually assign this to). Know which Deployment method — Declarative or VM image — fits your scenario; see the Overview & Decision Matrix if you haven't settled that yet.

Steps

If you're going Declarative: there's no VM to build here — you'll pick Windows Enterprise or Custom ISO directly when creating the Golden Image in Stage 3. Skip to the provisioning package step below if you want Intune enrollment.

If you're going VM image:

1. Build and configure the VM in Parallels Desktop's Control Center.

   Attention: Building a Windows virtual machine means handling Windows OS licensing yourself, which is separate from the Parallels Desktop license from Stage 1. Make sure your Windows activation method (volume license key, KMS, or domain-based activation) is in place before you Sysprep and export; an unactivated or improperly licensed Windows install will carry that problem into every VM provisioned from this image.

2. Shut it down completely (not suspended).

3. Right-click it and choose Prepare for Transfer to export a .pvmp file — this comes with a .txt file containing its SHA-256 checksum. If you're missing that file, regenerate it with shasum -a 256 {file_path} in Terminal.

4. Upload the .pvmp to your connected Azure Storage, or to a location that supports direct, unauthenticated links.

If your Windows VMs need Intune enrollment (either method):

1. Install Windows Configuration Designer and create a new project from the Provision desktop devices template.

2. On Set up network, turn the toggle off.

3. On Account Management, select Enroll in Azure AD and sign in with your Azure credentials to obtain a bulk token.

4. Click Create and note the resulting package's file path.

Attention: The bulk token is valid for a maximum of 180 days. This is a Day-2 item — mark your calendar, since VMs will keep provisioning even after the token expires, they'll just silently stop enrolling in Intune.

Test the provisioning package manually on one machine before relying on it for the full group.

Verification

If you built a VM image: the .pvmp and its checksum file are both present and the upload link works without authentication. If you built a provisioning package: it installs and successfully enrolls a test VM in Intune.

Common issues

Provisioning packages can fail silently due to network issues reaching Microsoft services, or an expired bulk token — always test manually first.

Handoff to next stage

With your image (or Declarative source choice) and provisioning package ready, move to Stage 3 to create the Golden Image and Policy in the Management Portal.