How to Set Up Windows Autopilot in Microsoft Intune from Scratch

Enable automatic MDM enrollment: In Intune, go to Devices > Enrollment > Windows > Automatic Enrollment. Set MDM user scope to Some (for pilot) or All. If Some, select your pilot user group.

Create a dynamic device group: Go to Groups > New group. Type: Security, name: "Autopilot Devices", membership: Dynamic Device. Add this rule:

1(device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))

This auto-includes any device registered with Autopilot.

Register devices: Option A (recommended): request OEM registration from Dell, HP, Lenovo, or Microsoft during purchase. Provide your Entra tenant ID.

Option B: manual registration via PowerShell on each device:

1Install-Script -Name Get-WindowsAutoPilotInfo -Force
2Get-WindowsAutoPilotInfo -Online

Sign in with Intune admin credentials when prompted. For bulk: export to CSV with -OutputFile C:\Hashes.csv then import in Intune > Devices > Windows enrollment > Devices > Import.

Devices registered via OEM appear within 24-48 hours. PowerShell-registered devices appear within 15 minutes. Windows 11 SE devices can only be registered through OEM partners.

Create deployment profile: Go to Devices > Windows > Windows enrollment > Deployment Profiles > Create profile > Windows PC.

Configure OOBE settings:

• Deployment mode: User-driven
• Join to Entra ID as: Microsoft Entra ID joined
• Hide: License terms, privacy settings, change account options
• User account type: Standard
• Device name template: CORP-%SERIAL%

Assign to your "Autopilot Devices" dynamic group.

Create Enrollment Status Page: Go to Devices > Windows > Windows enrollment > Enrollment Status Page > Create.

Configure:

• Show app and profile installation progress: Yes
• Timeout: 60 minutes
• Block device use until all apps and profiles installed: Yes
• Allow users to reset device on error: Yes
• Only show for OOBE: Yes

Select critical required apps to block on (e.g. Microsoft 365 Apps, Company Portal).

Assign to the same "Autopilot Devices" group.

Profile changes only apply to devices going through OOBE (new or reset). Existing enrolled devices need a factory reset. Set ESP timeout high enough for your app installations (30-60 minutes is typical).

Reset a registered device: Settings > System > Recovery > Reset this PC > Remove everything > Clean the drive.

Boot the device and connect to the internet. The Autopilot flow should proceed automatically:

1. Device detects the Autopilot profile ("Setting up for work or school")
1. Device renames per your template and reboots
1. User signs in with Entra ID credentials
1. ESP shows installation progress
1. Desktop appears with all apps and policies applied

Verify on the device:

1dsregcmd /status   # AzureAdJoined: YES
2manage-bde -status  # BitLocker active if configured
3Get-AppxPackage | Where-Object {$_.Name -like '*Office*'}

Verify in Intune: Devices > All devices > find the device > check Compliance, Installed apps, and Configuration profiles.

Monitor ongoing deployments: Use Devices > Monitor > Enrollment failures for issues. For diagnostics on a failed device:

1mdmdiagnosticstool.exe -area Autopilot -cab C:\AutopilotDiag.cab

Target: 95% success rate, deployment time under 30 minutes.

Document the timing of each phase during pilot testing. Typical breakdown: profile detection 5 min, rename+reboot 3 min, user sign-in 2 min, ESP app install 10-30 min. If ESP times out, remove non-critical apps from the required list or increase the timeout.