A Simple Configuration Guide
Prerequisites, configuration flow, and troubleshooting tips for Windows Autopilot Device Preparation
Quick overview
This guide walks through the exact order to prepare Microsoft Entra ID and Intune, create the Device Preparation policy, and test the setup on a Windows 11 device.
Check the Prerequisites
Before creating the policy, make sure the tenant, user, and test device meet the following requirements. Completing these checks first avoids most enrollment failures.
☐ A supported Windows 11 device: version 24H2 or later, or version 23H2/22H2 with KB5035942 or later.
☐ Microsoft Entra ID and Microsoft Intune are available for the organization.
☐ The user has the required Microsoft Intune license.
☐ Windows automatic Intune enrollment is enabled for the user.
☐ The user is allowed to join devices to Microsoft Entra ID.
☐ The device is not registered as a classic Windows Autopilot device.
☐ An assigned device security group is available for enrollment-time grouping.
☐ An assigned user security group is available for policy assignment.
☐ The device has reliable internet access during Windows OOBE.
☐ Corporate identifiers are prepared if personal Windows enrollment is blocked.
Important
If the device is registered in classic Windows Autopilot, the classic Autopilot profile takes priority. Remove that registration before testing Windows Autopilot Device Preparation.
Create two Security Groups
Group | Example name | Membership |
Device group | APV2-Devices | Assigned device security group |
User group | APV2-Pilot-Users | Assigned user security group |
2. Configure Windows Autopilot V2
Follow the steps in this order. Each step shows where the setting is located and what needs to be configured.
Step 1: Enable automatic Intune enrollment
Automatic enrollment allows the Windows device to enroll into Intune after the user joins the device to Microsoft Entra ID.
Where to configure it
Microsoft Entra admin center > Mobility (MDM and MAM) > Microsoft Intune
MDM user scope: Select All, or select the pilot user group.
Validation: Confirm the test user is included in the selected scope and has an Intune license.
Step 2: Allow users to join devices
The user signing in during OOBE must be allowed to join the device to Microsoft Entra ID.
Where to configure it
Microsoft Entra admin center > Devices > Device settings
Users may join devices to Microsoft Entra ID: Select All or the approved user group.
Device limit: Confirm the user has not reached the allowed device limit.
Step 3: Create the device group
This group receives the device during enrollment and is used for essential apps and scripts.
Where to configure it
Microsoft Entra admin center > Groups > All groups > New group
Group type: Security
Membership type: Assigned
Example name: APV2-Devices
Helpful tip
Device Preparation uses an assigned security group for enrollment-time grouping. Keep this separate from dynamic Autopilot groups.
In device security group add the Intune Provisioning Enterprise Application object an an Owner. Do not add any devices in that group as a member
Step 4: Create the user group
This group identifies the users who receive the Device Preparation policy during OOBE.
Where to configure it
Microsoft Entra admin center > Groups > All groups > New group
Group type: Security
Membership type: Assigned
Example name: APV2-Pilot-Users
Members: Add only users during the pilot.
Step 5: Prepare the required applications
Add or confirm the essential applications that must be installed before the user reaches the desktop.
Where to configure it
Microsoft Intune admin center > Apps > All apps
Assignment: Assign each selected app as Required to APV2-Devices.
Install context: Use System context when the application must install during OOBE.
Selection limit: The Device Preparation policy can select up to 25 managed applications.
Helpful tip
Choose only business-critical apps for OOBE. Deploy optional and large applications after the user reaches the desktop.
Step 7: Create the Device Preparation policy
Create the policy that controls the user-driven Windows setup experience.
Where to configure it
Microsoft Intune admin center > Devices > Windows > Enrollment > Device preparation policies > Create
Name: Windows Autopilot V2 - User Driven
Deployment mode: User-driven
Deployment type: Single user
Join type: Microsoft Entra joined
User account type: Standard User
Device group: APV2-Devices
Configure the OOBE Settings
Setting | Suggested configuration |
Minutes allowed before showing installation error | Choose a value appropriate for the required apps and scripts. The available range is 15 to 720 minutes. |
Custom error message | Provide a clear message telling the user how to contact the IT support team. |
Allow users to skip setup after multiple attempts | Choose based on whether the organization allows access when required setup fails. |
Show link to diagnostics | Select Yes to make diagnostic collection easier after a deployment failure. |
Step 8: Select apps and scripts in the policy
In the Apps and Scripts sections, select the same essential content that is already assigned to APV2-Devices.
Apps: Select the required managed applications.
Scripts: Select the required PowerShell scripts.
Check before continuing: Every selected item must also be assigned to APV2-Devices.
Step 9: Assign the policy to users
Assign the completed Device Preparation policy to the pilot user group.
Included group: APV2-Pilot-Users
Pilot approach: Start with a small group and expand after successful testing.
Step 10: Add corporate identifiers when needed
This step is needed only when Intune enrollment restrictions block personal Windows devices.
Where to configure it
Microsoft Intune admin center > Devices > Enrollment > Corporate device identifiers
Required values: Add the Windows device serial number, manufacturer, and model.
When to use: Use this when only corporate-owned Windows devices are allowed to enroll.
Step 11: Test the deployment
Use a new supported Windows 11 device or reset an eligible test device so that Windows OOBE starts.
1. Choose the region and keyboard layout.
2. Connect the device to the internet.
3. Choose the work or school setup option.
4. Sign in using a user from APV2-Pilot-Users.
5. Allow the device to join Microsoft Entra ID and enroll into Intune.
6. Wait while the selected applications install and PowerShell scripts run.
7. Confirm the setup completes and the user reaches the Windows desktop.
What happens in the background
During enrollment, the device is added to APV2-Devices. The apps and scripts selected in the policy are then processed during the Device Preparation experience.
3. Verify the Deployment
After the user reaches the desktop, confirm the deployment was successful.
☐ The device appears in Microsoft Intune under Windows devices.
☐ The device is Microsoft Entra joined.
☐ The device is a member of APV2-Devices.
☐ The required applications are installed.
☐ The PowerShell script configurations are present.
☐ The Device Preparation deployment report shows the deployment result and individual app/script status.
☐ The signed-in user has the account type configured in the policy.
4. Troubleshooting Tips
Start with identity and enrollment checks, then move to application and script troubleshooting.
The Device Preparation screen does not appear
☐ Confirm the user is a member of APV2-Pilot-Users.
☐ Confirm the policy is assigned to that group and the user is not excluded.
☐ Confirm the Windows 11 build meets the minimum requirement.
☐ Confirm the device is not registered in classic Windows Autopilot.
☐ Reset the device and test OOBE again with the pilot user.
The device cannot join Microsoft Entra ID
☐ Confirm the user is allowed to join devices in Microsoft Entra device settings.
☐ Check whether the user has reached the device limit.
☐ Confirm the user account is active and correctly licensed.
☐ Check internet access, DNS, date, and time on the device.
☐ After Windows sign-in is available, run dsregcmd /status and check that AzureAdJoined shows YES.
The device joins Entra ID but does not appear in Intune
☐ Confirm the MDM user scope includes the signing-in user.
☐ Confirm the user has an Intune license.
☐ Review Windows enrollment restrictions in Intune.
☐ If personal enrollment is blocked, verify the corporate identifier exactly matches the device.
The device is not added to APV2-Devices
☐ Confirm APV2-Devices is an assigned security group.
☐ Confirm the Device Preparation policy references the correct group.
☐ Check whether enrollment completed successfully.
☐ Review the Device Preparation deployment report for the profile and deployment phase.
An application fails or provisioning becomes stuck
☐ Confirm the application is selected in the policy and assigned as Required to APV2-Devices.
☐ Check the application requirements, dependencies, detection rule, and return codes.
☐ Confirm the app uses System context when it installs during OOBE.
☐ Review IntuneManagementExtension.log and AgentExecutor.log.
☐ Remove nonessential apps from OOBE and test the failing app separately.
A PowerShell script does not apply
☐ Confirm the script is selected in the policy and assigned to APV2-Devices.
☐ Check whether the script should run in 32-bit or 64-bit PowerShell.
☐ Confirm the script uses the correct user or System context.
☐ Review IntuneManagementExtension.log and AgentExecutor.log.
☐ Test the script separately on the same Windows version.
The classic Enrollment Status Page appears
☐ Check whether the device exists in classic Windows Autopilot device records.
☐ Remove classic Autopilot profile assignments and deregister the device when appropriate.
☐ After removal is complete, reset the device and restart OOBE.
The deployment times out
☐ Use the deployment report to identify the last app or script being processed.
☐ Check proxy, firewall, DNS, content download, and TLS inspection behavior.
☐ Remove optional or unreliable content from the OOBE selection.
☐ Use a realistic overall deployment timeout.
☐ Enable the diagnostics link in the policy so logs can be collected from the failure page.
Useful Commands and Log Locations
Check Microsoft Entra join status
dsregcmd /status
Intune Management Extension logs
C:\ProgramData\Microsoft\IntuneManagementExtension\Logs
Log | What to check |
IntuneManagementExtension.log | Application and script policy processing, content download, detection results, and return codes. |
AgentExecutor.log | PowerShell script execution details. |
Device Preparation deployment report | Deployment phase, selected application status, and selected PowerShell script status. |
Final tip
Keep the first pilot simple: one or two essential applications, one well-tested script, one device group, and a small user group. Add more content only after the basic flow works reliably.
Microsoft Documentation
For the latest requirements and interface changes, review the official Microsoft Learn pages below.
Overview of Windows Autopilot device preparation
https://learn.microsoft.com/en-us/autopilot/device-preparation/overview
Windows Autopilot device preparation requirements
https://learn.microsoft.com/en-us/autopilot/device-preparation/requirements
Create a Windows Autopilot device preparation policy
https://learn.microsoft.com/en-us/autopilot/device-preparation/tutorial/user-driven/entra-join-autopilot-policy
Comments
Post a Comment