Windows Autopilot deployment provisions Windows devices during the out-of-box experience, enrolling them into Microsoft Intune and Microsoft Entra ID with little or no hands-on setup. You can run it zero-touch or user-driven, depending on the mode you choose. Before you start, licences, device registration and network access to the Autopilot service must all be in place.
What should you check before starting a Windows Autopilot setup?
Most delays we see come from skipped preflight checks, so confirm each of these before a single device is unboxed. Microsoft’s requirements page groups them into software, networking, licensing and configuration tasks.
- Operating system: check that each device runs a Windows edition and version that Autopilot supports.
- Licences: confirm the Microsoft Intune and Microsoft Entra entitlements that cover your users or devices.
- Roles: make sure your administrators hold Intune roles with permission to import devices, build profiles and assign groups.
- Network: allow the Autopilot deployment service endpoints and the sign-in endpoints, and follow the proxy guidance in the same documentation.
- Registration route: decide between OEM or partner registration and manual CSV upload, and keep each manual CSV import to about 500 rows.
- TPM: if you plan to use pre-provisioning, plan for TPM attestation from the outset.
Autopilot depends on Microsoft Entra ID and an MDM such as Microsoft Intune, and Microsoft lists specific endpoints such as ztd.dds.microsoft.com and login.live.com that devices must reach.
If either of those endpoints is blocked, devices may be unable to complete OOBE. Check network access before treating a stalled setup as a faulty profile.
Which Autopilot deployment mode suits your estate?
Autopilot offers several deployment scenarios. In user-driven mode, the person receiving the device signs in and the device configures itself around their identity. In self-deploying mode, no user signs in at all, which suits shared or kiosk-style hardware. In pre-provisioned mode, a technician or partner completes the technical stage first, so the user only finishes the final steps.
On join type, Microsoft recommends deploying new devices as cloud-native with Microsoft Entra join, as set out in its hybrid join guidance. Hybrid join still has a place when you depend on on-premises resources, but it brings extra moving parts:
- The Intune Connector for Active Directory must be installed and healthy.
- Devices need a line of sight to a domain controller, which can mean VPN planning.
- Every extra dependency is another place for a first boot to fail.
Self-deploying and pre-provisioned modes both rely on TPM attestation, so check that your hardware supports it before you commit to either. If you have no strong reason for hybrid join, start cloud-native and treat hybrid as the exception.
How do you register devices in your tenant?
Autopilot only recognises a device in OOBE if its identity is already registered to your tenant. Microsoft’s registration documentation describes three collection methods: Configuration Manager extraction, the Get-WindowsAutopilotInfo PowerShell script, and the diagnostics page. Use Configuration Manager if you already manage the estate with it, PowerShell for a fleet refresh or a small batch, and the diagnostics page for one-off devices.
For large purchases, Microsoft recommends partner or OEM registration through Partner Centre. It has a reliability caveat, though. Microsoft’s registration overview notes that manual hash capture with PowerShell is often more reliable than relying only on partner uploads, particularly when serial numbers are mismatched or missing.
For a manual import, follow these steps:
- Run the PowerShell script on each device and export the results to a CSV file.
- Check that the header row and the serial number, hardware hash and optional group tag fields are intact.
- Split the file so that each import stays at or below about 500 rows.
- In the Microsoft Intune admin centre, import each file and wait for processing to finish.
- Open the Windows Autopilot devices list and confirm that every serial number appears with the expected group tag.
- Investigate any import errors before you move on, starting with hash and serial number problems.
Pro Tip: Keep a simple register of serial numbers against purchase orders. When a device fails to appear after import, you can tell at a glance whether the fault lies with your CSV or with your supplier’s registration.
How do you build and assign Autopilot deployment profiles?
A deployment profile tells a registered device how to behave on first boot. The settings that matter most are these:
- Deployment mode: user-driven or self-deploying.
- Join type: Microsoft Entra join or Microsoft Entra hybrid join.
- OOBE options: which screens users see and which they skip.
- Convert targeted devices to Autopilot: registers existing devices in the targeted groups automatically.
Think carefully before enabling the convert option. It applies to every device in the assigned group, so a loosely defined group can pull in machines you never meant to reprovision. Use tightly scoped device groups, ideally driven by a group tag you set at registration, and keep pilot and production groups separate.
Automatic MDM enrolment hooks into the same assignment. Intune supports automatic enrolment with Autopilot in user-driven and self-deploying modes, provided the right Microsoft Entra licensing is in place. If you also run Configuration Manager, co-management is an option.
What network and hybrid requirements apply?
Whatever mode you pick, devices must reach the Autopilot deployment service and, where relevant, the TPM attestation endpoints. If you use a proxy, Microsoft’s guidance is to configure it at the proxy server rather than pushing settings through Intune where you can avoid it, and to check WPAD behaviour in your environment.
| Item | Requirement |
|---|---|
| Autopilot deployment service | ztd.dds.microsoft.com reachable from the device |
| Sign-in | login.live.com reachable from the device |
| Intune Connector server | Windows Server |
| Intune Connector runtime | .NET Framework |
| Connector connectivity | Internet access and Active Directory access |
For hybrid join, Microsoft’s connector documentation states that the server hosting the Intune Connector for Active Directory needs internet and Active Directory access and must connect successfully to the domain controller. Check the connector’s service account and permissions during installation, not after your first failed enrolment.
If devices will start life off the corporate network, the Skip Domain Connectivity Check option in the profile lets domain join proceed without an immediate connection to a domain controller.
How should you pilot, roll out and troubleshoot?
Run a small pilot before any volume rollout. A phased plan with defined checkpoints, such as the 30/60/90 checkpoint approach published by Pipeline, gives you a sensible shape: pilot first, a wider phase second, full scale last.
- Register a handful of devices and assign them a pilot profile.
- Take each one through OOBE as a real user would.
- Confirm the profile applied and that Intune policies and apps arrived.
- Fix what you find, then widen to a second group.
- Move to full rollout only when the earlier phases are clean.
If an import reports an error or a record is missing a serial number or manufacturer, check the hardware hash and device details. Recapture the hash on the device rather than editing the CSV by hand. After enrolment, check the device in the Intune admin centre and confirm the profile status and policy delivery before you sign off the phase.
Pro Tip: Log every pilot failure with the device serial number and the screen where it stalled. Patterns show up quickly, and the log gives you everything a support escalation needs.
How do procurement and security affect Autopilot success?
Procurement is where many rollouts quietly fail. NCSC guidance on provisioning and distributing devices points to supply-chain coordination as a dependency.
The NCSC recommends Windows Autopilot with MDM management on Windows 10 and 11, noting that zero-touch enrolment lets administrators provision non-administrative accounts during initial device setup.
That fits our own practice, summed up in Security by Default. Before you scale up, work through this checklist:
- Procurement sign-off names your tenant as the registration target on every order.
- Network readiness covers endpoints, proxy rules and, for hybrid, the connector server.
- A pilot plan exists with named owners and exit criteria.
- A fallback is agreed for devices that fail OOBE.
- Someone monitors devices that should have enrolled but have not, since that gap often signals a supply-chain or registration fault.
Our device lifecycle management guide covers the wider stages these checks belong to.
How can we support your Autopilot project?
If your internal team is stretched, or procurement and security questions are slowing the project, we can take on the delivery with you. Our endpoint management service covers monitoring once devices are enrolled. Alongside it, our managed IT support, Microsoft 365 management and managed cyber security services can cover the identity, licensing and protection work that surrounds an Autopilot rollout.
Managed support suits you best when you have limited internal capacity, a complicated purchasing chain or security concerns about how devices reach users. Tell us where you are in the process through our managed IT support page and we will agree the next step with you.
FAQ
What is a Windows Autopilot pre-provisioned deployment?
Pre-provisioned deployment splits setup in two. A technician or partner completes the technical stage first, then the user finishes the remaining steps on first sign-in. It relies on TPM attestation, so confirm your hardware supports it.
Is Autopilot the same as Intune?
No. Autopilot handles the first-boot provisioning experience, while Microsoft Intune is the management platform that enrols and then manages the device. Microsoft’s requirements list Microsoft Entra ID and an MDM such as Intune as dependencies.
How much does Windows Autopilot cost?
Windows Autopilot requires suitable Microsoft Intune and Microsoft Entra licensing. Check your own agreement or ask your licensing reseller for exact figures.
How do you stop Windows Autopilot on a device?
Remove the device’s Autopilot registration in the Intune admin centre and, where needed, remove its profile assignment or group membership. Without a registration and a profile, the device will not follow the Autopilot flow at its next OOBE.
