Home >
Microsoft Intune >
Windows Autopilot Deployment Guide (Real-World Setup)
Last Updated: July 2026
Windows Autopilot is Microsoft’s zero-touch provisioning service that lets a brand-new or reassigned Windows device configure itself the first time it powers on. In real-world deployments, the hardware hash is registered by the OEM or reseller at the time of purchase, an IT admin builds a deployment profile and Enrollment Status Page (ESP) in Intune, and the device joins Microsoft Entra ID and installs apps automatically when the end user signs in — with no imaging and no IT hands-on-device required.
Table of Contents
- What Is Windows Autopilot?
- Real-World Deployment vs. Lab Testing
- Prerequisites for a Production Rollout
- Choosing a Deployment Scenario
- Step 1: Registering Devices with Your OEM or Reseller
- Registering Existing (Non-OEM) Devices
- Step 2: Building the Deployment Profile
- Step 3: Configuring the Enrollment Status Page
- Step 4: Groups, Apps, and Configuration Profiles
- End-to-End Architecture Diagram
- Piloting and Scaling the Rollout
- Common Real-World Issues
- Frequently Asked Questions
What Is Windows Autopilot?
Windows Autopilot is a cloud-based provisioning service built into Microsoft Intune and Microsoft Entra ID (formerly Azure Active Directory). It replaces traditional imaging: instead of IT staff reinstalling an operating system on every laptop before it reaches a user, Autopilot configures the device automatically the first time it connects to the internet.
A device becomes an “Autopilot device” once its unique hardware hash is uploaded to your tenant. From that point on, whenever the device reaches the Out-of-Box Experience (OOBE) screen and gets a network connection, it checks in with the Autopilot service, downloads its assigned deployment profile, and follows the instructions IT configured in advance.
Real-World Deployment vs. Lab Testing
Testing Autopilot on a virtual machine is a great way to validate a deployment profile before rollout. However, production deployment differs in one major way: nobody manually extracts a hardware hash on a real device. That step is handled upstream, by the hardware supply chain.
| Step | Lab / VM Test | Real-World Production |
|---|---|---|
| Hash extraction | Run Get-WindowsAutoPilotInfo.ps1 manually | OEM/reseller uploads hash automatically before shipping |
| Device state | Reset VM to OOBE | Ships factory-fresh, never booted |
| Scale | 1 device | Dozens to thousands, grouped by “Group Tag” |
| Delivery | N/A | Shipped directly to the employee’s home or office |
In other words, the profile design, ESP configuration, and app assignment logic are identical between lab and production. What changes is who performs the hash registration and at what scale.
Prerequisites for a Production Rollout
Before rolling Autopilot out to real users, confirm the following is in place. Skipping any of these is the most common cause of a stalled pilot.
Licensing
You need one of: Microsoft 365 Business Premium, Microsoft 365 E3/E5, EMS E3/E5 combined with Windows 10/11 Enterprise, or a standalone Intune Plan 1 license per user. Without an Intune license assigned to the signing-in user, enrollment fails silently at the ESP stage.
Tenant Readiness
Microsoft Entra ID must be configured with MDM automatic enrollment pointed at Intune. As a result, any device that joins Entra ID also enrolls in Intune without a separate manual step.
Admin Roles
You need Global Administrator or, more securely, a combination of Intune Administrator and Cloud Device Administrator roles. Because Autopilot touches both Entra ID device objects and Intune policy, a single narrow role is rarely enough.
Choosing a Deployment Scenario
Autopilot supports three distinct scenarios. Picking the right one for each device type matters more than any individual setting.
| Scenario | Who touches the device before the user | Best for |
|---|---|---|
| User-Driven (Zero Touch) | Nobody | Remote employees, standard laptops |
| Self-Deploying | Nobody (no user sign-in required) | Kiosks, shared devices, conference room PCs |
| Pre-Provisioned (White Glove) | IT or reseller partially provisions first | Executives, devices needing a fast first sign-in |
For most organizations, User-Driven with Microsoft Entra join is the default. It requires the least logistics and matches the “ship straight to the employee” model most companies want.
Step 1: Registering Devices with Your OEM or Reseller
This is the step that differs most from lab testing. When you purchase devices through an enterprise channel — Dell, HP, Lenovo, Microsoft Surface for Business, or a reseller such as CDW or Insight — you request Autopilot registration as part of the order.
- Provide your Entra ID tenant ID to the OEM or reseller at time of order (found in Entra admin center > Overview).
- The vendor extracts the hardware hash on the factory floor or warehouse and uploads it directly to your tenant via their Autopilot partner integration.
- Devices appear automatically under Intune > Devices > Enrollment > Windows Autopilot devices, typically within a few hours of shipment.
- Optionally, ask the vendor to apply a “Group Tag” per purchase order (e.g.,
SALES-2026Q3) so devices can be dynamically grouped later.
Because this happens before the box is ever opened, no one on your team touches the operating system. The laptop arrives, the employee opens it, and provisioning starts the moment it connects to Wi-Fi.
Registering Existing (Non-OEM) Devices
Not every device comes pre-registered. If you’re converting devices already owned by the company — repurposing old laptops, or buying retail units without an enterprise agreement — IT registers them manually.
Install-Script -Name Get-WindowsAutoPilotInfo -Force Get-WindowsAutoPilotInfo.ps1 -OutputFile C:\HWID.csv -GroupTag "IT-Refresh-2026"
Upload the resulting CSV under Intune > Devices > Enrollment > Windows Autopilot devices > Import, then reset the device to OOBE (Settings > System > Recovery > Reset this PC > Remove everything) before handing it back to a user.
This manual path should be the exception, not the rule. If your company buys more than a handful of devices per quarter, a vendor registration agreement pays for itself in IT hours saved.
Step 2: Building the Deployment Profile
Once devices exist in your Autopilot device list, create a deployment profile under Intune > Devices > Enrollment > Windows Autopilot deployment program > Deployment Profiles.
Recommended OOBE Settings for Production
| Setting | Recommended Value |
|---|---|
| Deployment mode | User-Driven |
| Join type | Microsoft Entra joined |
| License terms / Privacy settings | Hide |
| User account type | Standard (never Administrator) |
| Apply device name template | Yes — e.g. CORP-%SERIAL% |
Assign this profile to a dynamic device group. A useful production rule targets devices by the Group Tag your reseller applied, for example a query matching devices whose Group Tag starts with a specific purchase order prefix. This way, every new shipment automatically inherits the correct profile without IT re-assigning anything.
Step 3: Configuring the Enrollment Status Page
The Enrollment Status Page (ESP) is what the end user watches while apps and policies install. In production, the ESP setting that matters most is blocking device use until required apps and profiles finish installing — otherwise employees start working before security baselines and line-of-business apps are in place.
- Show app and profile installation progress: Yes
- Block device use until required apps and profiles are installed: Yes
- Show a timeout error after a set number of minutes: 60, with a custom message pointing to your helpdesk
- Allow users to collect logs on failure: Yes — this is critical for remote support since IT can’t put hands on the device
For remote employees especially, a clear timeout message with a support contact is essential. If the device stalls with no explanation, the employee has no local IT desk to walk over to.
Step 4: Groups, Apps, and Configuration Profiles
ESP, apps, and configuration profiles are typically assigned to a user group rather than a device group, since the goal is to configure whichever device that user happens to sign into. Only the Autopilot deployment profile itself needs to target a device group.
Apps Must Be “Required,” Not “Available”
This is the single most common misconfiguration in real deployments. If an app is assigned as “Available,” it appears in Company Portal for the user to install manually — it will never install during ESP. Set every app that must exist before first use to Required.
Also confirm large apps are flagged to install during the “Device setup” phase of ESP rather than after, so the block-until-installed setting actually waits for them.
End-to-End Architecture Diagram
The diagram below shows the full real-world flow, from OEM registration through to a ready-to-use device.
OEM / ResellerRegisters hardwarehash to your tenantbefore shippingIntune / AutopilotDeployment profile +ESP assigned todevice groupEnd UserUnboxes device,connects at OOBE,signs inEntra ID + IntuneDevice join, appinstall, policy pushvia ESP, ready to use
Diagram note: paste this section into a WordPress Custom HTML block, not a Paragraph block.
Piloting and Scaling the Rollout
Never assign a new deployment profile to your entire device population on day one. Instead, run a staged rollout so mistakes affect five people, not five hundred.
Ring 1: IT Pilot
Target 3-5 IT-owned test devices first. Confirm the full ESP flow, app installs, and compliance policy evaluation succeed end to end.
Ring 2: Volunteer Users
Expand to a small group of real, non-IT employees across different departments. As a result, you catch app conflicts or missing line-of-business dependencies that IT devices never surface.
Ring 3: General Availability
Once Ring 2 completes with no blocking issues for at least a week, assign the profile broadly using the OEM Group Tag dynamic group so every future purchase order inherits it automatically.
Common Real-World Issues
| Symptom | Likely Cause | Fix |
|---|---|---|
| Device shows standard Windows setup, not company branding | Hash not yet synced, or profile not assigned | Check Autopilot devices list; click Sync; confirm Profile status = Assigned |
| ESP hangs indefinitely | App assigned as Available instead of Required | Change app assignment intent to Required |
| User can’t sign in at all | Missing Intune license or blocked by Conditional Access | Confirm license assignment and exclude Autopilot flow from restrictive CA policies during enrollment |
| Device never appears in Intune after sign-in | MDM automatic enrollment not enabled | Entra admin center > Mobility (MDM/MAM) > set Microsoft Intune scope to All |
Frequently Asked Questions
Does Windows Autopilot reformat or reimage the device?
No. Standard Autopilot uses the operating system already on the device from the factory. It only reformats if you explicitly use a reset-based scenario like Autopilot Reset.
Who registers the hardware hash in a real deployment?
The OEM or reseller registers it before shipping, as part of an enterprise purchase agreement. IT only registers hashes manually for existing or repurposed devices.
Can an end user complete Autopilot without any IT involvement?
Yes, in User-Driven mode the end user only connects to Wi-Fi and signs in. All configuration happens automatically in the background.
What licensing does Windows Autopilot require?
You need Microsoft Intune licensing, available through Microsoft 365 Business Premium, Microsoft 365 E3/E5, EMS plus Windows Enterprise, or standalone Intune Plan 1.
What’s the difference between Zero Touch and White Glove?
Zero Touch (User-Driven) has IT do nothing before shipping. White Glove has IT or the reseller pre-stage some setup so the first sign-in is faster for the end user.
Why is my ESP screen stuck on “Installing apps”?
This usually means a required app is failing to install, or was mistakenly assigned as Available instead of Required. Check the app status details on the ESP screen itself.
Should apps be assigned to a user group or device group?
Assign apps, config profiles, and the ESP to a user group. Only the Autopilot deployment profile itself needs to target a device group.
Can Autopilot join a device to on-premises Active Directory?
Yes, using Hybrid Microsoft Entra Join instead of Microsoft Entra joined as the join type, provided Entra Connect or Cloud Sync is configured beforehand.
How long does Autopilot provisioning take for a new employee?
Typically 15-40 minutes depending on the number and size of required apps, though this varies with network speed and app count.
What happens if the device loses internet during ESP?
Provisioning pauses and resumes once connectivity returns; a persistent loss triggers the ESP timeout error after the configured minute limit.
Can I test a production deployment profile safely?
Yes, assign it first to a small pilot device group of IT-owned test hardware before rolling it out broadly to real employees.
Does the device need a local IT technician present?
No, that’s the core benefit of Autopilot. It’s designed for devices shipped directly to remote or hybrid employees with no on-site IT support.
What is a Group Tag used for?
A Group Tag is a label applied to a batch of Autopilot devices, often per purchase order, that lets you build dynamic device groups without manually adding each serial number.
Antonio Rennvick is an IT Infrastructure Manager with 15+ years running enterprise Active Directory, Microsoft 365, and Azure environments. He’s Microsoft certified (AZ-104, MS-102) and writes Core365 Cloud to share what actually works in production—PowerShell automation, AD deep dives, and security hardening drawn from real-world work, not test labs.
