Stackvora.tech

Microsoft Intune: enroll Windows 11 devices via Autopilot

Microsoft Autopilot streamlines the deployment and initial configuration of Windows devices, transforming the out-of-box experience (OOBE) for end-users…

Microsoft Autopilot streamlines the deployment and initial configuration of Windows devices, transforming the out-of-box experience (OOBE) for end-users and significantly reducing IT overhead. This document details the process of enrolling Windows 11 devices into Microsoft Intune using Autopilot, focusing on the practical steps from hardware hash registration to deployment profile assignment.

Autopilot facilitates zero-touch provisioning, enabling new devices to automatically enroll into Intune, join Azure Active Directory (AAD) or Hybrid AAD, and apply policies, applications, and settings the first time a user signs in. This eliminates the need for IT personnel to physically interact with each device during initial setup.

Prerequisites for Autopilot Deployment

Before initiating Autopilot deployment, ensure the following prerequisites are met:

  • Microsoft Intune Subscription: A valid Intune license (e.g., Enterprise Mobility + Security E3/E5, Microsoft 365 F3/E3/E5, Microsoft 365 Business Premium).
  • Azure Active Directory Premium: Required for advanced features like dynamic groups and hybrid AAD Join. AAD P1 or P2 is sufficient.
  • Windows 10/11 Devices: Devices must be running a supported version of Windows 10 (1709 or newer) or Windows 11.
  • Network Connectivity: Devices require internet access during OOBE to reach Intune and Azure AD services. Specific URLs and ports must be accessible (e.g., *.manage.microsoft.com on TCP 443).
  • User Accounts: Azure AD user accounts with appropriate Intune licenses assigned.

Step 1: Registering Devices with Autopilot (Hardware Hash Upload)

The core of Autopilot is associating a device's unique hardware identifier, known as a hardware hash, with your Intune tenant. This hash can be obtained in several ways:

Vendor Registration

Many OEMs (e.g., Dell, HP, Lenovo, Microsoft Surface) offer services to directly register devices purchased through them into your Autopilot program. This is the most efficient method for bulk deployments as devices ship with their hashes pre-uploaded.

Manual Hash Collection (Existing Devices)

For existing devices or those not registered by a vendor, you can manually collect the hardware hash using a PowerShell script. This script needs to be run on each device. It's recommended to perform this on a fresh installation of Windows 11 if possible, or before any sensitive data is on the machine.


# Create a folder for the script
New-Item -Path "C:\Autopilot" -ItemType Directory -ErrorAction SilentlyContinue

# Set execution policy for the current scope to allow the script to run
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass

# Install the Get-WindowsAutoPilotInfo script from the PowerShell Gallery
Install-Script -Name Get-WindowsAutoPilotInfo -Force

# Run the script to generate the CSV file
Get-WindowsAutoPilotInfo -OutputFile "C:\Autopilot\hardware_hash.csv" -Format CSV

# The output file C:\Autopilot\hardware_hash.csv will contain the device's hardware hash.
# It can then be uploaded to Intune.

The generated CSV file typically contains columns like Device Serial Number, Windows Product ID, and Hardware Hash. Ensure you collect the hardware hash for devices you intend to manage.

Uploading Device Information to Intune

Once you have the CSV file, upload it to the Intune portal:

  1. Navigate to endpoint.microsoft.com.
  2. Go to Devices > Windows > Windows enrollment.
  3. Under Windows Autopilot Deployment Program, select Devices.
  4. Click Import, select your CSV file, and click Import.
  5. Allow a few minutes for the import process to complete. Refresh the page to see the imported devices.

Step 2: Creating an Autopilot Deployment Profile

An Autopilot deployment profile defines the OOBE experience and device configuration settings. These settings determine how the device behaves during its initial setup.

  1. From the Intune portal (endpoint.microsoft.com), navigate to Devices > Windows > Windows enrollment.
  2. Under Windows Autopilot Deployment Program, select Deployment profiles.
  3. Click Create profile > Windows PC.
  4. Basics:
    • Name: Autopilot_Profile_Win11_AAD_Join (or similar descriptive name)
    • Description: Standard Autopilot profile for Windows 11 AAD-joined devices.
  5. Out-of-box experience (OOBE) settings:
    • Deployment mode: User-driven (most common for standard users) or Self-deploying (preview) for kiosks/shared devices.
    • Join to Azure AD as: Azure AD joined (for cloud-native) or Hybrid Azure AD joined (requires Intune Connector for Active Directory).
    • Microsoft Software License Terms: Hide (recommended)
    • Privacy settings: Hide (recommended for consistent experience)
    • Hide change account options on sign-in: Hide
    • User account type: Standard user or Administrator (typically Standard user for security).
    • Allow pre-provisioned deployment (preview): No (unless using White Glove pre-provisioning).
    • Language (Region): Operating system default or specify (e.g., English (United States)).
    • Automatically configure keyboard: Yes.
    • Apply device name template: Yes (e.g., %SERIAL%, DESK-%RAND:4% for unique naming). This is only for Azure AD joined devices. Hybrid AAD devices get their names from the on-prem AD.
  6. Assignments: Assign the profile to an Azure AD group containing your Autopilot devices (discussed in Step 3).
  7. Review + create: Review the settings and click Create.

Autopilot Profile Settings Considerations:

  • User-driven vs. Self-deploying: User-driven is for specific users logging in. Self-deploying enrolls the device without user interaction and is ideal for shared or kiosk devices, but has stricter hardware requirements (TPM 2.0).
  • Azure AD Joined vs. Hybrid Azure AD Joined: Choose AAD Joined for cloud-native management. Hybrid AAD Joined requires an on-premises domain controller and the Intune Connector for Active Directory installed on a server within your domain to provision the computer object before the device joins the domain. This process is more complex and has additional requirements (e.g., line of sight to a DC during OOBE).
  • Device Naming: For Azure AD joined, use templates like DESK-%SERIAL% for consistency. Hybrid AAD devices are named by the on-premises domain join profile.

Step 3: Assigning the Profile to an Azure AD Group

Autopilot profiles are assigned to Azure AD security groups. For dynamic management, it's best to use dynamic groups that automatically include devices based on specific attributes.

Creating a Dynamic Azure AD Group

  1. Navigate to aad.portal.azure.com.
  2. Go to Azure Active Directory > Groups > All groups.
  3. Click New group.
  4. Group type: Security
  5. Group name: SG_Autopilot_Devices_Win11 (or similar)
  6. Membership type: Dynamic Device
  7. Click Add dynamic query.
  8. Configure the rule:
    • Property: devicePhysicalIds
    • Operator: Contains
    • Value: [ZTDId]

    The full rule syntax will be (device.devicePhysicalIds -any _ -contains "[ZTDId]"). This query identifies devices registered with Autopilot. You can refine this further, for example, by adding and (device.deviceOSType -eq "Windows") and (device.deviceOSVersion -startsWith "10.0.2") for Windows 11 devices.

  9. Click Add query, then Create.

Assigning the Autopilot Profile

  1. Go back to your Autopilot deployment profile in Intune (Devices > Windows > Windows enrollment > Deployment profiles).
  2. Select the profile you created (e.g., Autopilot_Profile_Win11_AAD_Join).
  3. Go to Assignments.
  4. Click Add groups and select the dynamic Azure AD group you just created (e.g., SG_Autopilot_Devices_Win11).
  5. Click Select, then Save.

Once assigned, Intune will automatically distribute the Autopilot profile to any devices that become members of this group.

Step 4: User Experience and Verification

When an end-user powers on a new Windows 11 device that has been registered with Autopilot and assigned a profile:

  1. The device connects to the internet (ethernet or Wi-Fi).
  2. It checks for Autopilot registration.
  3. The OOBE experience is customized according to the deployment profile (e.g., showing a custom branding, skipping EULA).
  4. The user is prompted to sign in with their Azure AD credentials.
  5. The device joins Azure AD (or Hybrid AAD), enrolls in Intune, and begins receiving policies, applications, and settings configured in Intune.
  6. After the user logs in, the desktop appears, and Intune continues to apply configurations in the background.

Verification in Intune

To verify a device has successfully enrolled via Autopilot:

  1. In the Intune portal, navigate to Devices > Windows.
  2. Locate the device. Its Enrollment method should show Windows Autopilot.
  3. Check Monitor > Autopilot deployments for deployment status.

Common Pitfalls and Troubleshooting

  • Hardware Hash Not Uploaded/Processed: Ensure the hardware hash CSV was uploaded correctly and the device appears in the "Windows Autopilot devices" list. Allow up to 15 minutes for Intune to process new device registrations.
  • Profile Not Assigned: Verify the Autopilot deployment profile is assigned to an Azure AD group that includes the target device. Check dynamic group membership processing time; it can take a few minutes for devices to appear.
  • Network Connectivity Issues: The device must have internet access during OOBE. Ensure no firewalls or proxies are blocking access to required Microsoft endpoints (see Intune network endpoints).
  • Hybrid Azure AD Join Complexity: This method is more complex. Issues often stem from the Intune Connector for Active Directory (AD Connector) not being healthy, incorrect Organizational Unit (OU) permissions, or line-of-sight problems to domain controllers. Review the AD Connector logs (Event Viewer > Applications and Services Logs > Microsoft > Windows > DeviceManagement-Enterprise-Diagnostics-Provider > Admin).
  • Device Not Reset Before Autopilot: If a device was previously used or configured, it might retain old settings. Ensure the device is factory reset or wiped before attempting Autopilot. Use Shift + F10 during OOBE to open a command prompt and run mdmreset.exe (Windows 10 1709+) or reimage if necessary.
  • User Licenses: Ensure the Azure AD user signing in has a valid Intune license assigned.
  • Time Sync Issues: Incorrect device time can cause certificate validation failures.

Back to the knowledge base · Ask the AI assistant