Windows Autopilot Device Preparation (Autopilot V2)

Autopilot Prerequisites

Below settings need to be applied before creating any autopilot profile.

Follow the below path to these changes. 

Device > Enrollment > Enrollment Options > Automatic Enrollment

  

 

 

Device Group Creation 

A device group must be created based on your requirement, either as an Assigned group or a Dynamic group. In this example, I am using a Dynamic Device Group.

Once the device hardware hash is uploaded, whether through a CSV import, OEM registration, or online registration, the device will be automatically added to the dynamic device group when it meets the defined membership criteria. This eliminates the need for manual device assignment and ensures that devices are enrolled and managed automatically.

You need to create dynamic device group like below, so it will be added once its hash value uploaded in Intune.

 (device.devicePhysicalIds -any (_ -startsWith "[ZTDid]"))

Device Registration

Before deployment, each device must be registered with the Windows Autopilot deployment service. Registration associates the device hardware identity with the organization tenant and enables Autopilot profile assignment during OOBE.

Registration Methods

·       OEM or reseller registration: Preferred for new hardware procurement, where the vendor registers devices directly to the tenant.

·       Manual hardware hash upload: Used for existing or test devices by collecting the hardware hash and uploading it to Intune.

·       Automatic registration: Used when eligible corporate devices are targeted through supported Autopilot registration settings.(Mostly used in Autopilot V2)

 

 

Set-ExecutionPolicy -Scope Process -ExecutionPolicy Unrestricted

Install-Script -Name Get-WindowsAutoPilotInfo

Get-WindowsAutoPilotInfo.ps1 -Online -Verbose

 

Device Registration Steps,

·       1. There are many ways to import or upload the new device to Intune as discussed above, but I will select online upload at the time fresh device setup.

·       2. Open command prompt through Shift + F10 and run this command powershell.exe so it will open  PowerShell in the cmd terminal and run above syntax.

·       3. It will ask you to authenticate with the user but make sure user has to be Global administrator or Intune administrator role.

 Autopilot V1 Configuration Steps

 1. Autopilot Deployment Profile

In the Microsoft Intune admin center, create a Windows Autopilot deployment profile from Devices > Windows > Enrollment > Windows Autopilot > Deployment Profiles. The profile controls the deployment mode and customizes the Windows out-of-box experience for assigned devices.

Setting	Recommended Value	Notes
Deployment mode	User-driven	Recommended for standard user-assigned corporate devices.
Join to Microsoft Entra ID as	Microsoft Entra joined	Cloud-native deployment approach.
User account type	Standard	Use least privilege unless local admin rights are required.
Hide Microsoft Software License Terms	Yes	Reduces OOBE interaction.
Hide privacy settings	Yes	Provides consistent corporate setup.
Device name template	MB-%SERIAL%	Update prefix as per organization naming standard.
Allow pre-provisioned deployment	Optional	Enable only if IT or vendor will pre-stage devices before delivery.

 

In Assignment add the dynamic device group which we created earlier.

 2. Enrollment Status Page Configuration

The Enrollment Status Page displays provisioning progress during device setup and can block device use until required apps and policies are installed. Configure a custom ESP profile for Autopilot V1 devices rather than relying only on the default profile.

Please follow the path below to complete the configuration,

Device > Enrollment > Windows Autopilot > Enrollment Status Page

 

 

ESP Setting	Recommended Value	Reason
Show app and profile configuration progress	Yes	Allows users and IT to see provisioning status.
Block device use until required apps are installed	Yes	Prevents users from accessing an incomplete build.
Timeout	60 minutes	Adjust based on app size and network performance.
Custom error message	Yes	Provide service desk contact details and retry guidance.
Allow users to reset device on error	Yes	Provides recovery option during failed provisioning.
Allow users to collect logs	Yes	Helps support teams troubleshoot Autopilot failures.

 

 

 Assigned the same dynamic group.

3. Application and Policy Assignment

·       Assign critical security tools and management agents as required apps to the Autopilot device group.

·       Assign baseline configuration profiles, including Wi-Fi, VPN, certificates, device restrictions, Windows Update, and endpoint security settings.

·       Keep the list of blocking apps small to reduce ESP timeout risk.

·       Use user-targeted apps after sign-in where immediate device readiness is not required.

·       Validate application detection rules before production rollout.

 4. Validation Checklist

Validation Item	Expected Result	Status
Device appears in Windows Autopilot devices	Device serial number is visible and assigned to the correct profile.	Pending
Deployment profile assigned	Profile status shows assigned before OOBE starts.	Pending
Microsoft Entra join completed	Device join type is Microsoft Entra joined.	Pending
Intune enrollment completed	Device appears in Intune with recent check-in.	Pending
ESP completed successfully	Required apps and profiles complete within the configured timeout.	Pending
Compliance evaluated	Device reports compliant or shows expected remediation actions.	Pending

5. Troubleshooting

Issue	Possible Cause	Action
Autopilot profile not received	Device not registered, profile not assigned, or group membership delay.	Confirm device hash upload, group membership, and profile assignment.
ESP timeout	Large app install, failed app detection, or network delay.	Review blocking apps, app detection rules, and network connectivity.
Device not Intune enrolled	Automatic MDM enrollment not configured or user lacks license.	Validate MDM user scope, licensing, and enrollment restrictions.
Hybrid join delay	On-premises connector, line-of-sight, or domain join configuration issue.	For V1 cloud deployment, prefer Microsoft Entra join unless hybrid join is specifically required.