Windows Autopilot
Device enrollment

Overview of Windows Autopilot Device Preparation | Microsoft Learn

In brief

The overview now details deployment precedence based on device association and states that registered devices must be deregistered before using device preparation without associating them. It also includes wording and formatting updates.

What Intune admins need to know

Administrators using registered devices in this scenario must deregister them first.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

The comparison below shows only the changed extract. Use the full-page view for complete context.

Overview of Windows Autopilot device preparationDevice Preparation | Microsoft Learn

Use Windows Autopilot device preparation is used to set up and configure new devices, getting them ready for productive use. Windows Autopilot device preparation aims to simplify device deployment by delivering consistent configurations, enhancing the overall setup speed, and improving troubleshooting capabilities.

This article explores the capabilities of the Windows Autopilot device preparation, its benefits for administrators, and the user experience it offers including:offers.

  • ReducingReduce the time IT spends on deploying devices.
  • ReducingReduce the infrastructure required to maintain the devices.
  • MaximizingMaximize ease of use for all types of end users.
  • ImprovedImprove troubleshooting.
  • NearAchieve near real-time deployment status and monitoring.

Note

  • Windows 11, version 24H2 or later.

  • Windows 11, version 23H2 with KB5035942 or later.

  • Windows 11, version 22H2 with KB5035942 or later.

  • Microsoft Entra ID - onlyID. Only Microsoft Entra join is supported.

  • If the device is registered as a Windows Autopilot device, which deployment runs depends on the device's association state.

    • If the device isn't associated with the tenant, the Windows Autopilot profile takes precedence.
    • If the device is associated, device association takes precedence and the Windows Autopilot device preparation deployment runs.

    To use Windows Autopilot device preparation on a registered device without associating it, first deregister the device.

For additional detailed requirements, see Windows Autopilot device preparation requirements.

Process overview

When new Windows devices are initially deployed, Windows Autopilot device preparation uses the OEM-optimized version of Windows client. The OEM-optimized version of Windows client is preinstalled on the device, sodevice. You don't need to maintain custom images and drivers don't need to be maintained for every device model. Instead of re-imaging the device, withby using Windows Autopilot device preparation, you can transform the existing Windows installation can be transformed into a "business-ready" state that can:

  • Deliver Windows Autopilot device preparation configuration during device provisioning.
  • Automatically add devices to the device security group and receive selected applications and PowerShell scripts assigned to the group.

Windows Autopilot device preparation improvements

Windows Autopilot device preparation is an improved profile experience that incorporates common customer asks.requests. It improves the onboarding experience by providing a profile experience to deploy configurations efficiently, consistently, and remove the complexity out of troubleshooting. Its goal is to be:

  • Simple.Simple
  • Fast.Fast
  • Observable.Observable
  • Reliable.Reliable

New features in Windows Autopilot device preparation include:

  • Utilizing enrollment time grouping in Intune - Device. The device is added to a device security group at enrollment time and configuration is delivered immediately. This feature provides a faster and more reliable setup. For more information, see Enrollment Time Grouping.

  • Granular reporting -. Improved monitoring and troubleshooting. Monitoring and reporting with near real-time status of deployments, including:

    • Applications status
    • PowerShell scripts status
    • Deployment time.time

    For more information, see Windows Autopilot device preparation reporting and monitoring.

  • Support for Government Community Cloud High (GCCH) and Department of Defense (DoD) environments -. Windows Autopilot device preparation supports GCCH and DoD environments.

  • Important

    Windows Autopilot device preparation capabilities include:

    • Set up user-driven or automatic deployment flow.
    • By default, making sureensure users are standard non-administrator users.
    • Select application and PowerShell script to be delivereddeliver during device setup.
    • Simplified and clear OOBE user experience with percentage progress indicator for user-driven flows.
    • Deployment report for better troubleshooting.

    Admin experience

    • Windows Autopilot device preparation simplifies admin configuration by havingproviding a single profile to provision all policies in one location, including deployment and OOBE settings.
    • Line-Deploy line-of-business (LOB) and Win32 applications can be deployed in the same deployment.

    User experience

    • A simplified view during OOBE where the percentage of progress is displayed.
    • The experience is more consistent.
    • The user is informed when the OOBE setup is complete.
    • When issues arise, logsyou can be exportedexport logs with ease.
    • The end-end user gets to the desktop faster.

    Troubleshooting and Reportingreporting

    Windows Autopilot device preparation offers near real-time status updates on deployments. Windows Autopilot device preparation monitoring includes application and PowerShell script status information, allowing for improved troubleshooting and reporting. Deployment monitoring includes the following features:

    • Easily track which devices that went through Windows Autopilot device preparation.

    • Track status and deployment phase for each device in near real-time.

    • Each device has the following details in the monitoring report:

      • Device details.details
      • Profile name and version.version
      • Deployment status details.details
      • Apps applied with status.status
      • Scripts applied with status.status

    Enrollment Time Groupingtime grouping

    The key to Windows Autopilot device preparation is Enrollment Time Grouping. With Enrollment Time Grouping, whenenrollment time grouping. When a user authenticates into a device, the device is added to a pre-definedpredefined device security group during enrollment. Applications, scripts, and policies assigned to theThe device group are then deployed to the device. Direct assignment of devices to the device group allows thereceives applications, scripts, and policies assigned to that device group. When you directly assign devices to the device group to deploy quickergroup, the deployment of applications, scripts, and policies happens faster and more efficiently versusthan when usingyou use a dynamic device group.

    Enrollment time grouping consists of the following phases:

    • Configure applications and policies to a security group -. User authenticates and the Windows Autopilot device preparation configuration is delivered.
    • Select applications and PowerShell scripts to get installedinstall during OOBE - Selected. The device installs selected applications and PowerShell scripts assigned to the device security group are installed.group. The device also joins the device security group.

    For Windows Autopilot device preparation:

    • TheYou select the device group is selected in the Windows Autopilot device preparation profile.
    • Only applications and PowerShell scripts selectedthat you select in the Windows Autopilot device preparation profile are deployeddeploy during OOBE. Any additionalIf the device group has other applications or PowerShell scripts assigned toassigned, the device group will be deployedinstalls them after the Windows Autopilot device preparation deployment is complete.finishes.
    • For policies, Windows Autopilot device preparation syncs any policies assigned to the device group. However, Windows Autopilot device preparationit doesn't track if the policies are applied during the deployment. The policies might be applied either during the deployment or after the deployment is complete.finishes.

    For more information, see Enrollment time grouping in Microsoft Intune.

    Corporate identifiers for Windows

    Windows Autopilot device preparation supports the Intune corporate identifier enrollment feature. CorporateBy using corporate identifiers in Intune allowsIntune, you can pre-uploading ofupload Windows device identifiers (serialsuch as the serial number, manufacturer, model) and model. This process ensures only trusted devices go through Windows Autopilot device preparation.

    Windows Autopilot device preparation only requires corporate identifiers for Windows if you use Intune enrollment restrictions are being used to block personal device enrollments. For more information, see:

    Device association

    Daily Intune.Admin.News

    Get daily email updates

    Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

    Loading the secure signup form…