Windows Autopilot lets you ship a new laptop straight from the supplier to an employee. They switch it on, sign in with their work account, and the device configures itself with your security settings and apps. No imaging, no IT desk visit.
This step-by-step guide explains how to set up Windows Autopilot with Microsoft Intune, the deployment modes to choose from, and the mistakes that slow rollouts down.
How Windows Autopilot Works
- The device’s hardware hash is registered in your tenant.
- An Autopilot profile is assigned to the device.
- The user switches on the device and connects to the internet.
- Windows recognises the device and shows your company’s sign-in page.
- The device joins Entra ID and enrols in Intune.
- Intune installs policies, certificates and apps before the user reaches the desktop.
Prerequisites
- Microsoft Intune and Entra ID P1 licences (included in Business Premium, E3 and E5).
- Windows 10 or 11 Pro, Enterprise or Education.
- Automatic MDM enrolment enabled in Entra ID.
- Company branding configured for the sign-in page.
- Internet access to required Microsoft endpoints.
New to Intune? Start with our Intune deployment checklist.
Step-by-Step: Set Up Windows Autopilot in Intune
Step 1: Register devices
Ask your reseller to register new devices to your tenant, or collect the hardware hash from existing devices with the Get-WindowsAutopilotInfo script and import the CSV in Intune.
Step 2: Create a device group
Create a dynamic Entra ID group that captures Autopilot devices, so profiles and apps are assigned automatically.
Step 3: Create a deployment profile
In Intune, go to Devices, Windows, Enrollment, Deployment profiles. Choose the join type, hide unnecessary setup screens, set the user account type to standard user and apply a device naming template.
Step 4: Configure the Enrollment Status Page
The Enrollment Status Page (ESP) holds users on a progress screen until required apps and policies are installed. Only block on essential apps to keep setup fast.
Step 5: Assign apps and policies
Assign Microsoft 365 Apps, security baselines, BitLocker, Windows Update rings and compliance policies to the device group.
Step 6: Test with a pilot device
Reset a test device and go through the full experience as a user. Measure time to desktop and fix any app that fails.
Autopilot Deployment Modes Compared
| Mode | Best for | How it works |
|---|---|---|
| User-driven | Most staff laptops | User signs in and setup completes on the device |
| Pre-provisioning | Large rollouts and slow networks | IT or partner pre-installs apps before shipping |
| Self-deploying | Kiosks and shared devices | No user sign-in required |
| Existing devices | Refreshing current fleet | Re-imaged or reset devices enter Autopilot |
Common Autopilot Mistakes
- Blocking the ESP on too many apps, making setup slow or failing.
- Hybrid join without a clear need, adding VPN and domain controller dependencies.
- Forgetting BitLocker escrow to Entra ID.
- Giving users local admin rights by default.
- Not testing on each hardware model you buy.
Securing Devices After Autopilot
Autopilot gets devices enrolled. Security baselines, Defender for Endpoint and compliance policies keep them safe. See our endpoint hardening services. For mixed Windows and Apple fleets, read Intune vs Apple Business Manager.
Roll Out Autopilot With M365 Enterprise Hub
We design and deploy Autopilot and Intune for organizations across the UAE and Saudi Arabia, including migrations from SCCM and other MDM tools. Explore our endpoint and device management expertise and Intune and MDM migration services, or book a free Autopilot readiness review.
Frequently Asked Questions
What is Windows Autopilot?
Windows Autopilot is a Microsoft cloud service that sets up new or reset Windows devices automatically. Users sign in with their work account and the device joins Entra ID, enrols in Intune and installs apps and policies.
What licences does Windows Autopilot need?
You need Microsoft Intune and Microsoft Entra ID P1, which are included in Microsoft 365 Business Premium, E3 and E5, plus a supported edition of Windows 10 or 11.
How do devices get registered for Autopilot?
Devices are registered by uploading their hardware hash to Intune, or by your hardware reseller or OEM registering them on your behalf when you buy them.
Can Autopilot be used for existing laptops?
Yes. Capture the hardware hash from existing devices, upload it to Intune, then reset the devices to start the Autopilot experience.
What is pre-provisioning in Autopilot?
Pre-provisioning lets IT or a partner install apps and policies before the device reaches the user, so the user’s setup finishes faster.
Does Autopilot work with hybrid Entra join?
It does, but Microsoft recommends Entra join for new deployments because it is simpler and does not need line of sight to a domain controller.
How long does Autopilot setup take for a user?
Usually 15 to 45 minutes depending on the number of apps and network speed. Pre-provisioning can shorten this.