Windows Autopilot device preparation is the next generation of Windows Autopilot, re-architected from the ground up. Per Microsoft Learn, it delivers consistent configurations, faster setup, and improved troubleshooting with near real-time deployment monitoring.
Unlike legacy Autopilot, device preparation doesn't require pre-registering devices with hardware hashes. A user signs into a new Windows 11 24H2+ device during OOBE, and if a device preparation policy is assigned to that user, the device automatically joins Entra, enrolls in Intune, and installs up to 25 apps.
This tutorial covers the user-driven Microsoft Entra join scenario, which is the most common deployment model.
Before you start
What you will learn
- You'll learn how to configure Windows Autopilot device preparation (v2) in Microsoft Intune for user-driven Microsoft Entra join deployments.
- Windows Autopilot device preparation is Microsoft's re-architecture of Windows Autopilot. Per Microsoft Learn, it simplifies deployment, improves troubleshooting, and offers near real-time monitoring. It doesn't require device registration (hardware hash upload) like legacy Autopilot.
Requirements
- Intune admin center (intune.microsoft.com) with Intune Administrator role. Microsoft Entra admin center for security group creation.
- Windows 11 version 24H2 or later on target devices.
- Intune Administrator
- Cloud Device Administrator
Good to know
- 30 minutes for initial configuration
Quick answer
In the Intune admin center, go to Devices > Windows > Enrollment > Windows Autopilot device preparation > Device preparation policies > Create > User Driven. Configure your Entra join settings, select up to 25 apps, assign scripts, and target a user group. New devices running Windows 11 24H2+ will be configured automatically during OOBE.
Intune admin center > Devices > Windows > Enrollment > Windows Autopilot device preparation > Device preparation policies > CreateStep-by-step tutorial
5 stepsCreate a Security Group for Target Users
Create an Entra security group to target with the device preparation policy.
entra.microsoft.com > Groups > All groups > New groupIn entra.microsoft.com, go to Groups > All groups > New group. Set Group type to Security, give it a name (e.g., 'Autopilot Device Prep Users'), and add the users who will set up new devices. Click Create.
You can use a dynamic group based on user attributes for automated membership.
Create a Device Preparation Policy
Configure the Autopilot device preparation policy in Intune.
Devices > Windows > Enrollment > Device preparation policies > Create > User DrivenIn intune.microsoft.com, go to Devices > Windows > Enrollment. Under Windows Autopilot device preparation, click Device preparation policies. Click Create, then select User Driven.
On the Configuration page:
- Give the policy a name
- Select the Device security group (a group the device will join after enrollment)
- Configure User account type (Standard User or Administrator)
- Set the Language/Region and Keyboard layout
Per Microsoft Learn FAQ, pre-provisioning mode and self-deploying mode aren't supported yet.
Select Apps and Scripts
Choose which apps and scripts run during OOBE setup.
On the Apps page, select up to 25 applications to install during OOBE. Supported app types: Win32, LOB, Microsoft Store, and Enterprise App Catalog apps. Per the January 2026 update, the limit was increased from 10 to 25.
On the Scripts page, add up to 10 PowerShell scripts to run during device setup.
Click Next to proceed to Assignments.
Per the April 2026 update, managed installer policy is now supported for apps during OOBE. Keep essential apps only during OOBE; deploy non-essential apps after the user reaches the desktop for a faster setup experience.
Assign the Policy to the User Group
Target the policy at the users who will provision new devices.
On the Assignments page, click Add groups and select the security group you created in Step 1. Click Select, then Next, and finally Create.
The policy targets users, not devices. When a user in the assigned group signs into a new device during OOBE, the policy is delivered.
Test on a New Device
Verify the device preparation policy works during OOBE.
Power on a new Windows 11 24H2+ device (or reset an existing one). During OOBE, select your region and keyboard layout. Connect to the network. When prompted to sign in, enter the credentials of a user in the assigned group.
The device preparation policy is delivered. The device joins Microsoft Entra, enrolls in Intune, installs the management extension, and runs through the app and script installations.
Monitor progress in near real-time from the Intune admin center: Devices > Monitor > Windows Autopilot device preparation deployments.
Monitor Deployment Status in Real Time
Windows Autopilot device preparation provides near real-time deployment monitoring. Per Microsoft Learn, you can track deployment progress phase by phase: policy installation, app installation, and script execution.
In the Intune admin center, go to Devices > Monitor > Windows Autopilot device preparation deployments. Each deployment shows its current phase and status (In progress, Succeeded, or Failed). If a phase fails, the report identifies the specific app or script that caused the failure.
This is a significant improvement over legacy Autopilot, which required waiting for the full ESP (Enrollment Status Page) to complete before seeing results.
- Deployment status shows 'Succeeded' for all phases. User reaches the desktop with all apps installed.
- Deployment status shows 'Failed' during app installation phase. Check the specific app that failed and verify its installation command.
Troubleshooting
Device preparation policy not delivered during OOBE
Cause: The user isn't in the assigned group, the device is registered as a legacy Autopilot device, or the device isn't running Windows 11 24H2+.
Verify the user is a member of the assigned security group. Check that the device is NOT registered in legacy Autopilot (Devices > Windows > Enrollment > Devices). Confirm the device runs Windows 11 24H2 or later.
App installation fails during OOBE
Cause: The app's install command fails silently, or there are more than 25 apps in the policy.
Verify the app's install and detection rules work independently before adding to the device preparation policy. Per the January 2026 update, the maximum is 25 apps. Remove non-essential apps from the OOBE deployment and deliver them after the user reaches the desktop.
Deployment shows 'Failed' in monitoring
Cause: A specific app or script failed during the deployment phase.
Check the deployment report (Devices > Monitor > Windows Autopilot device preparation deployments) to identify the failing phase and specific app/script. Fix the app configuration and retry.
Frequently asked questions
What is the difference between Autopilot and Autopilot device preparation?
Per Microsoft Learn, Autopilot device preparation is a re-architecture of Autopilot with a different underlying architecture. It doesn't require hardware hash registration, offers near real-time monitoring, and supports up to 25 apps during OOBE.
Does Autopilot device preparation support hybrid AD join?
No. Currently only Microsoft Entra join is supported for user-driven mode, and automatic mode for Windows 365. Hybrid AD join is not available in device preparation policies.
How many apps can I deploy during OOBE?
Up to 25 apps and 10 PowerShell scripts. Per the January 2026 update, the app limit was increased from 10 to 25.
Can I use device preparation on existing Autopilot devices?
No. Per Microsoft Learn, the Autopilot profile takes precedence over device preparation. Deregister the device from legacy Autopilot first before using device preparation.
What Windows version is required?
Windows 11 version 24H2 or later. Earlier versions are not supported by Autopilot device preparation.
