Windows Autopilot¶
Windows Autopilot turns a new device, straight from the box, into a managed corporate device. The user signs in with their work account, and Intune applies apps and policies. You never touch an image.
There are now two versions, and choosing between them is your first decision.
Autopilot or Autopilot device preparation?¶
Windows Autopilot device preparation is a rebuilt version of Autopilot. It's simpler to set up, faster and more observable, but it does fewer things. Classic Windows Autopilot remains fully supported and covers more scenarios.
| Requirement | Device preparation | Classic Autopilot |
|---|---|---|
| User-driven, Entra join | ||
| Pre-provisioning (technician phase) | ||
| Self-deploying (kiosk, shared) | ||
| Microsoft Entra hybrid join | ||
| Windows 365 automatic mode | ||
| Windows 10 | ||
| Device must be registered in advance | No | Yes |
| Win32 and line-of-business apps in the same deployment | Avoid | |
| Apps during setup | Up to 25 | Up to 100 blocking apps |
| PowerShell scripts during setup | Up to 10 | More than 10 |
| Block desktop until user-targeted config is applied | ||
| Near real-time deployment report | ||
| GCC High and DoD | ||
| HoloLens, Teams Rooms, DFCI, co-management |
Use device preparation for straightforward user-driven Windows 11 rollouts where you're happy to install a small set of essential apps during setup and the rest afterwards.
Use classic Autopilot when you need pre-provisioning, self-deploying mode, hybrid join, more than 25 apps during setup, or tight control over the out-of-box experience.
One device, one flow
If a device is registered for classic Autopilot and has a deployment profile assigned, the classic profile takes precedence. Device preparation is designed for devices that aren't registered in classic Autopilot.
Classic Autopilot setup¶
1. Register devices¶
| Method | When to use |
|---|---|
| OEM or reseller registration | Best option for new purchases. Ask your supplier to register devices to your tenant and add a group tag. |
| Hardware hash upload | Existing devices or small batches. Collect the hash and import a CSV under Devices > Enrollment > Windows > Devices > Import. |
| Convert targeted devices | The deployment profile setting Convert all targeted devices to Autopilot registers devices that are already enrolled. Useful for building up your Autopilot inventory over time. |
To collect a hardware hash on a device (as administrator, or during setup with Shift+F10):
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile C:\Temp\AutopilotHWID.csv
Use group tags
A group tag (for example Sales or Kiosk) travels with the device registration. Build dynamic device groups from it so devices land in the right deployment profile and policies automatically.
2. Create device groups¶
Dynamic membership rules that are useful for Autopilot:
Dynamic groups take time to update. For profile assignment that's fine, because devices are registered well before they're unboxed.
3. Create a deployment profile¶
Go to Devices > Enrollment > Windows > Deployment profiles > Create profile.
| Setting | Recommendation |
|---|---|
| Deployment mode | User-driven for one user, Self-deploying for kiosks and shared devices |
| Join to Microsoft Entra ID as | Microsoft Entra joined |
| Microsoft Software License Terms | Hide |
| Privacy settings | Hide |
| Hide change account options | Hide |
| User account type | Standard. Users shouldn't be local administrators. Use EPM or LAPS for the exceptions. |
| Allow pre-provisioned deployment | Yes, if your partners or service desk pre-provision devices |
| Language (Region) and keyboard | Set them for single-language sites, otherwise let the user choose |
| Apply device name template | Yes, for example CORP-%SERIAL%. Names are limited to 15 characters. %RAND:x% adds random digits. |
Assign the profile to your Autopilot device group. Check that registered devices show Profile status: Assigned before you ship them.
4. Configure the Enrollment Status Page¶
The Enrollment Status Page (ESP) shows progress during setup and can hold the user until critical apps and policies are installed. Configure it under Devices > Enrollment > Windows > Enrollment Status Page.
| Setting | Recommendation |
|---|---|
| Show app and profile configuration progress | Yes |
| Show an error when installation takes longer than | 60 minutes is the default. Raise it if your blocking apps are large, but fix slow apps rather than hiding them. |
| Turn on log collection and diagnostics page for end users | Yes. It lets users and the service desk collect logs when something fails. |
| Only show page to devices provisioned by out-of-box experience (OOBE) | Yes, so later users on the same device don't see the ESP |
| Install Windows quality updates (might restart the device) | Yes for most organizations, so new devices aren't months behind on patches. It adds time and a restart. |
| Block device use until all apps and profiles are installed | Yes |
| Block device use until these required apps are installed | Selected: list only the apps people need on day one, such as security agents, VPN and Company Portal |
| Allow users to reset device if installation error occurs | Yes |
| Allow users to use device if installation error occurs | Your call. No is safer, Yes reduces service desk calls. |
How the ESP decides what to wait for:
- It tracks only required apps that install in device context during the device phase, and user-context apps during the user phase.
- When you choose Selected blocking apps, other required apps are still installed, but the ESP doesn't wait for them. In user-driven and self-deploying flows, Win32, Microsoft Store and Enterprise App Catalog apps that aren't on the blocking list install after the ESP finishes.
- You can have up to 51 ESP profiles (the default plus 50). The highest-priority profile assigned to the device wins, then the user's.
Don't mix Win32 and line-of-business (MSI) apps during classic Autopilot
Both app types use the Windows Trusted Installer. During the ESP they can collide and fail. Package everything as Win32 apps. This limitation doesn't apply to Autopilot device preparation.
If you need to skip the user phase of the ESP (for example, to get users to the desktop faster), deploy a custom setting:
| Field | Value |
|---|---|
| OMA-URI | ./Vendor/MSFT/DMClient/Provider/MS DM Server/FirstSyncStatus/SkipUserStatusPage |
| Data type | Boolean |
| Value | True |
5. Assign apps and policies to devices¶
Target the security baseline, compliance, BitLocker, Defender, Wi-Fi and certificates to the device group so they apply during the device phase, before the user signs in. User-targeted items apply during the user phase.
Autopilot device preparation setup¶
-
Create an assigned device group in Entra ID and make the Intune Provisioning Client service principal (AppId
f1346770-5b25-470b-88bd-d5744ab7952c) its owner. In some tenants it's named Intune Autopilot ConfidentialClient. If it's missing, add it: -
Assign your essential apps and scripts to that device group. Devices join the group automatically during deployment (this is enrollment time grouping).
- Create a user group for the people allowed to run device preparation.
- Create the policy under Devices > Enrollment > Windows > Device preparation policies. Choose the device group, the user account type, up to 25 apps and up to 10 scripts that must install during setup, and the timeout and error options. Assign it to the user group.
- Decide how to trust devices. If you block personal Windows enrollment, upload Windows corporate identifiers or use device association first. Otherwise device preparation enrollments are blocked.
Known conflict: standard users and the Entra local administrator setting
If the device preparation policy sets User account type to Standard user while the Entra device setting Registering user is added as local administrator is Selected or None, provisioning can be skipped and users reach the desktop without their apps. Check Microsoft's known issues for the supported combinations before you roll out.
Other Autopilot scenarios¶
A technician (your service desk or the reseller) runs the device phase in advance, so the user's setup is short.
- Allow pre-provisioned deployment in the deployment profile.
- At the first setup screen, press the Win key five times and choose Pre-provision with Windows Autopilot.
- The device installs device-targeted apps and policies, then shows a green screen. Select Reseal.
- The user later unboxes the device and signs in; only the user phase remains.
Requires TPM 2.0 with attestation support and a physical device (not a virtual machine).
For kiosks, meeting rooms and shared devices with no assigned user. The device authenticates with its TPM, joins Entra ID and enrolls with no user interaction.
- Requires TPM 2.0 with attestation. Virtual machines aren't supported, even with a virtual TPM.
- Only device-targeted apps and policies apply.
- Combine with a kiosk or shared multi-user configuration profile.
Autopilot can join devices to on-premises Active Directory, but Microsoft recommends Entra join for new devices. If you must:
- Install the Intune Connector for Active Directory, version 6.2501.2000.5 or later. Older versions no longer process enrollments. The current connector runs under a managed service account (named
msaODJ#####), which needs Create Computer objects permission on the target OU. - Create a Domain Join profile with the OU and computer name prefix.
- The device needs line of sight to a domain controller during setup, which rules out most remote users.
- Connector logs are in Event Viewer under Applications and Services Logs > Microsoft > Intune > ODJConnectorService.
Autopilot for existing devices uses a Configuration Manager task sequence to reinstall Windows and then run an Autopilot deployment. It's the main way to move devices from hybrid join to Entra join with a clean OS.
Resets an Entra joined Autopilot device to a business-ready state while keeping it enrolled. It removes personal files, apps and settings.
- Remote: run Autopilot reset from the device in the Intune admin center.
- Local: press Ctrl+Win+R at the lock screen (requires the policy that enables local reset).
- Not supported for hybrid joined devices. Use a wipe and redeploy instead.
Deregistering devices¶
When a device leaves your organization for good (sold, returned at end of lease, written off), remove it in this order:
- Delete the device from Intune (Devices > All devices). The Autopilot record can't be deleted while the device is still enrolled.
- Deregister it from Autopilot under Devices > Enrollment > Windows > Devices.
- Delete the device object from Entra ID, if it still exists.
A registered device keeps coming back
A device that's still registered to your tenant shows your company's sign-in page after every reset, even in someone else's hands. Always deregister devices you sell or return. Before you delete the Intune record, back up the BitLocker recovery key and LAPS password if you might need them.
Troubleshooting Autopilot¶
| Symptom | Check |
|---|---|
| Device doesn't get the company setup experience | Registration exists, Profile status is Assigned, device has internet access during setup, and the time and date are correct |
| ESP times out | Which app is stuck (the ESP shows it). Large apps, apps waiting on a user context, or apps that restart the device are the usual causes. |
| "Securing your hardware" fails (0x800705b4 and similar) | TPM attestation problems during self-deploying or pre-provisioning. Update the TPM firmware and check network access to the TPM attestation endpoints. |
| Device preparation skips provisioning | Device group ownership (Intune Provisioning Client), user group assignment, the standard user conflict described above, and enrollment restrictions |
| Hybrid join fails | Connector status and version, MSA permissions on the OU, and domain controller reachability |
Collect logs on the device:
MdmDiagnosticsTool.exe -area "Autopilot;DeviceEnrollment;DeviceProvisioning" -cab C:\Temp\Autopilot.cab
Useful event logs live under Applications and Services Logs > Microsoft > Windows > ModernDeployment-Diagnostics-Provider and DeviceManagement-Enterprise-Diagnostics-Provider. See Logs and diagnostics for the full list.