Intune Device Enrollment: Windows Autopilot Setup

Overview

Windows Autopilot transforms device deployment by enabling IT to configure new devices with zero touch. Instead of imaging, Autopilot uses cloud-based configuration to transform devices from factory state to business-ready with minimal user interaction.

Who Should Use This Guide:

• IT administrators deploying new Windows devices
• Organizations transitioning from SCCM/ConfigMgr imaging
• MSPs managing multi-tenant device deployments
• Enterprises implementing modern device management

Autopilot Deployment Scenarios:

Requirements

Licensing Requirements:

Network Requirements:

Architecture

┌────────────────────────────────────────────────────────────────┐
│                  Windows Autopilot Flow                        │
├────────────────────────────────────────────────────────────────┤
│                                                                │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐        │
│  │   Factory   │    │   OEM/CSP   │    │   Intune    │        │
│  │   Device    │───▶│  Registers  │───▶│   Imports   │        │
│  │             │    │ Hardware ID │    │   Device    │        │
│  └─────────────┘    └─────────────┘    └──────┬──────┘        │
│                                               │                │
│                                               ▼                │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐        │
│  │   Device    │    │  Autopilot  │    │  Deployment │        │
│  │  Unboxed    │◀───│   Profile   │◀───│   Profile   │        │
│  │  by User    │    │  Assigned   │    │  Created    │        │
│  └──────┬──────┘    └─────────────┘    └─────────────┘        │
│         │                                                      │
│         ▼                                                      │
│  ┌─────────────┐    ┌─────────────┐    ┌─────────────┐        │
│  │    OOBE     │    │   Entra ID  │    │   Intune    │        │
│  │  Customized │───▶│   Join &    │───▶│   Config    │        │
│  │   Branding  │    │   MFA       │    │   Applied   │        │
│  └─────────────┘    └─────────────┘    └─────────────┘        │
│                                                                │
└────────────────────────────────────────────────────────────────┘

Process

Step 1: Collect Hardware Hashes

Obtain the hardware hash (device ID) for each device to register with Autopilot.

Method 1: PowerShell Script (Existing Devices)

Run on each device to collect the hardware hash:

# Install required module
Install-Script -Name Get-WindowsAutoPilotInfo -Force
 
# Collect hash and export to CSV
Get-WindowsAutoPilotInfo -OutputFile "C:\Temp\AutopilotHWID.csv"

Method 2: From Windows Settings (Single Device)

1. Open Settings → Accounts → Access work or school
2. Click Export your management log files
3. Navigate to C:\Users\Public\Documents\MDMDiagnostics
4. Open MDMDiagReport.html and find the Hardware Hash

Method 3: OEM Pre-Registration

Request your hardware vendor (Dell, HP, Lenovo) to register devices during ordering:

Verification: Hardware hash CSV contains Device Serial Number, Windows Product ID, and Hardware Hash columns.

Step 2: Import Devices to Autopilot

Register devices in Microsoft Intune for Autopilot deployment.

Import via Intune Portal:

1. Navigate to Microsoft Intune admin center
2. Go to Devices → Enrollment → Windows → Devices
3. Click Import
4. Upload the CSV file with hardware hashes
5. Click Import and wait for processing

Import via Microsoft Graph PowerShell:

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"
 
# Import devices from CSV
$devices = Import-Csv "C:\Temp\AutopilotHWID.csv"
 
foreach ($device in $devices) {
    $params = @{
        "@odata.type" = "#microsoft.graph.importedWindowsAutopilotDeviceIdentity"
        serialNumber = $device.'Device Serial Number'
        hardwareIdentifier = [Convert]::FromBase64String($device.'Hardware Hash')
        productKey = $device.'Windows Product ID'
    }
 
    New-MgDeviceManagementImportedWindowsAutopilotDeviceIdentity -BodyParameter $params
}

Verification: Devices appear in Devices → Windows → Windows enrollment → Devices with "Assigning" or "Assigned" status.

Step 3: Create Dynamic Device Group

Create an Entra ID group for Autopilot devices to target with profiles.

Navigate to: Entra admin center → Groups → New group

Create Dynamic Device Group:

Group type: Security
Group name: Autopilot-Devices
Membership type: Dynamic Device
Dynamic query:
 
(device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))

For Specific Deployment Profile:

(device.enrollmentProfileName -eq "Autopilot-Standard")

For Specific Order ID (Vendor Tag):

(device.devicePhysicalIds -any (_ -contains "[OrderId]:YourOrderID"))

Verification: Group populates with imported Autopilot devices (may take 15-30 minutes).

Step 4: Configure Company Branding

Customize the OOBE experience with organizational branding.

Navigate to: Entra admin center → User experiences → Company branding

Configure Branding Elements:

Verification: Visit https://login.microsoftonline.com to preview branding.

Step 5: Create Deployment Profile

Define the Autopilot deployment settings.

Navigate to: Intune → Devices → Enrollment → Deployment Profiles

Create Profile:

1. Click Create profile → Windows PC
2. Configure basics:
   • Name: Autopilot-Standard-UserDriven
   • Description: Standard user-driven deployment

Out-of-box experience (OOBE) settings:

Assignments:

• Assign to Autopilot-Devices dynamic group

CLI Alternative (Microsoft Graph):

$profileParams = @{
    "@odata.type" = "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile"
    displayName = "Autopilot-Standard-UserDriven"
    description = "Standard user-driven deployment"
    language = "os-default"
    extractHardwareHash = $true
    deviceNameTemplate = "CORP-%SERIAL%"
    deviceType = "windowsPc"
    enableWhiteGlove = $true
    outOfBoxExperienceSettings = @{
        hidePrivacySettings = $true
        hideEULA = $true
        userType = "standard"
        deviceUsageType = "singleUser"
        skipKeyboardSelectionPage = $true
        hideEscapeLink = $true
    }
}
 
New-MgDeviceManagementWindowsAutopilotDeploymentProfile -BodyParameter $profileParams

Step 6: Configure Enrollment Status Page (ESP)

Control the deployment experience and ensure apps/policies are installed.

Navigate to: Intune → Devices → Enrollment → Enrollment Status Page

Create ESP Profile:

1. Click Create
2. Configure:
   • Name: ESP-Standard
   • Show app and profile configuration progress: Yes
   • Show error when installation exceeds time limit: Yes
   • Show custom message for time limit errors: Yes
   • Error message: Deployment taking longer than expected. Contact IT at support@company.com

Blocking Apps (Wait for installation):

Timeout Settings:

Assignments:

• Assign to Autopilot-Devices or All Devices

Step 7: Assign Required Applications

Ensure critical apps deploy during Autopilot enrollment.

Recommended Autopilot Apps:

Assign Apps as Required:

1. Navigate to Apps → Windows
2. Select application
3. Go to Properties → Assignments
4. Add Required assignment to Autopilot device group
5. Enable Make this app required during ESP if available

Step 8: Test Deployment

Validate the Autopilot experience before production rollout.

Reset Test Device:

# From Windows 11 device
# Settings → System → Recovery → Reset this PC → Remove everything → Cloud download
 
# Or via command line
systemreset -cleanpc

OOBE Testing Checklist:

1. Device boots to customized OOBE with company branding
2. User enters corporate email, redirected to Entra ID sign-in
3. MFA prompt appears (if Conditional Access configured)
4. ESP shows app/profile installation progress
5. Desktop loads with all required apps installed
6. Device appears enrolled in Intune

Monitor Deployment:

Navigate to Intune → Devices → Monitor → Autopilot deployments

Troubleshooting

Common Issues:

Diagnostic Commands:

# View Autopilot profile on device
Get-Item "HKLM:\SOFTWARE\Microsoft\Provisioning\Diagnostics\AutoPilot"
 
# Check MDM enrollment status
dsregcmd /status
 
# View Autopilot ETL logs
Get-ChildItem "C:\Windows\Logs\MoSetup\UpdateSetupBox*.log"
 
# Export MDM diagnostics
mdmdiagnosticstool.exe -area Autopilot -zip "C:\Temp\AutopilotDiag.zip"

Collect Logs from Failed Deployment:

1. Press Shift+F10 during OOBE to open command prompt
2. Run: mdmdiagnosticstool.exe -area Autopilot -zip C:\Temp\logs.zip
3. Copy ZIP to USB drive for analysis

Security Considerations

Conditional Access for Enrollment:

Create CA policy to require compliant device for enrollment:

Name: Require Compliant Device - Windows Enrollment
Users: All users (exclude break-glass accounts)
Cloud apps: Microsoft Intune Enrollment
Conditions: Device platforms = Windows
Grant: Require device to be marked as compliant

Restrict Who Can Enroll:

Intune → Devices → Enrollment → Device platform restrictions
- Personally owned devices: Block
- Device limit: 5 devices per user

Device Naming Security:

• Avoid including user names in device templates
• Use serial numbers or random identifiers
• Consider CORP-%RAND:4%-%SERIAL:4% format

Verification Checklist

Autopilot Setup:

• Hardware hashes imported for all devices
• Dynamic device group created and populating
• Company branding configured
• Deployment profile created and assigned
• ESP profile configured with blocking apps

Pre-Deployment Testing:

• Test device resets to OOBE
• Autopilot profile applies automatically
• User-driven flow works with MFA
• Required apps install during ESP
• Device compliant in Intune post-enrollment

Production Readiness:

• Conditional Access policies reviewed
• Help desk trained on user experience
• Documentation updated for users
• Rollback plan documented

Next Steps

After implementing Autopilot:

1. Configure Windows Update for Business - Manage update rings
2. Deploy Microsoft Defender for Endpoint - Onboard devices for EDR
3. Implement Compliance Policies - Enforce security baselines
4. Set Up App Protection Policies - Protect corporate data

References

• Windows Autopilot Documentation
• Autopilot Networking Requirements
• Enrollment Status Page
• Autopilot Troubleshooting

Last Updated: February 2026