Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Windows Autopilot for Pre-provisioned Deployment | Microsoft Learn

30 October 2026Doc update+45 / −43 lines

In brief

The Windows Autopilot pre-provisioned deployment page now has a revised description, clearer wording about OEM, partner, IT, and end-user responsibilities, improved image descriptions, and updated links and formatting.

What Intune admins need to know

Administrators get clearer guidance for understanding the provisioning process, connectivity requirements, prerequisites, and known-issue resources.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Windows Autopilot for pre-Pre-provisioned deploymentDeployment | Microsoft Learn

Windows Autopilot helps organizations easily provision new devices by using the preinstalled OEM image and drivers. This functionality lets end users get their devices business-ready by using a simple process.

Diagram shows the OEM process, which includes the OEM and the end user.

Windows Autopilot can also provide a pre-provisioning service that helps partners or IT staff pre-provision a fully configured and business-ready Windows PC. From the end user's perspective, the Windows Autopilot user-driven experience is unchanged, but getting their device to a fully provisioned state is faster.

WithBy using Windows Autopilot for pre-provisioned deployment, you can split the provisioning process is split. The time-consuming portions are done byprocess. IT, partners, or OEMs.hardware manufacturers complete the time-consuming portions. The end user simply completes a few necessary settings and policies and then they can begin using their device.

Diagram shows the OEM process with partner between the OEM and the end user.

Pre-provisioned deployments use Microsoft Intune in currently supported versions of Windows. Such deployments build on existing Windows Autopilot user-driven scenarios and support user-driven mode scenarios for both Microsoft Entra joined and Microsoft Entra hybrid joined devices.

  • Windows Pro, Enterprise, or Education editions.
  • An Intune subscription.
  • Physical devices that support Trusted Platform Module (TPM) 2.0 and device attestation. Virtual machines aren't supported. The pre-provisioning process uses Windows Autopilot self-deploying capabilities, so TPM 2.0 is required. The TPM attestation process also requires access to a set of HTTPS URLs that are unique for each TPM provider. For more information, see the entry for Windows Autopilot self-Deploying mode and Windows Autopilot pre-provisioning in Networking requirements.
  • Network connectivity. Using wireless connectivity requires selecting region, languagelanguage, and keyboard before being able toyou can connect and start provisioning.
  • An enrollment status page (ESP) profile must be targeted to the device.

Important

  • Because the OEMmanufacturer or vendor performs the pre-provisioning process, this process doesn't require access to an end-user's on-prem domain infrastructure. The pre-provisioning process is unlike a typical Microsoft Entra hybrid joined scenario because rebootingrestarting the device is postponed. The device is resealed before the time when connectivity to a domain controller is expected. Instead the domain network is contacted when the device is unboxed on-premises by the end-user.
  • SeeTo review known issues, see Windows Autopilot known issues and Troubleshooting Windows Autopilot device import and enrollment to review known issues and their solutions..

Preparation

Devices slated for pre-provisioning are registered for Windows Autopilot viaby using the normal registration process.

To be ready to try out Windows Autopilot for pre-provisioned deployment, make sureensure that you can successfully use existing Windows Autopilot user-driven scenarios can be successfully used:scenarios:

  • User-driven Microsoft Entra join. Make sureEnsure that you can deploy devices can be deployedby using Windows Autopilot and join them to a Microsoft Entra ID tenant.

  • User-driven with Microsoft Entra hybrid join. To enable the features of Microsoft Entra hybrid join, make sureensure that you can perform the following actions can be performed:actions:

    • Deploy devices by using Windows Autopilot.
    • Join the devices to an on-premises Active Directory domain.
    • Register the devices with Microsoft Entra ID.

    Important

    Microsoft recommends deploying new devices as cloud-native by using Microsoft Entra join. Deploying new devices as Microsoft Entra hybrid join devices isn't recommended, including through Windows Autopilot. For more information, see Microsoft Entra joined vs. Microsoft Entra hybrid joined in cloud-native endpoints: Which option is right for your organization.

If these scenarios can't be completed, Windows Autopilot for pre-provisioned deployment also doesn't succeed since it builds on top of these scenarios.

The pre-provisioning process applies all device-targeted policies from Intune. Those policies include certificates, security templates, settings, apps, and more - anything targeting the device. Additionally, it installs any Win32 or line-of-business (LOB) apps are installed if theythat meet the following conditions:

  • Configured to install in the device context.
  • Assigned to either the device or to the user preassigned to the Windows Autopilot device.

Important

Make sure not toDon't target both Win32 and LOB apps to the same device. If you need to target both Win32 and LOB apps need to be targeted to the device, consider using Windows Autopilot device preparation. For more information, see Add a Windows line-of-business app to Microsoft Intune.

Note

To ensure easy access into pre-provisioning mode, select the language mode as user specified in Windows Autopilot profiles. The pre-provisioning technician phase installs all device-targeted apps and any user-targeted, device-context apps that are targeted to the assigned user. If there's no assigned user, then it only installs the device-targeted apps. OtherThe process doesn't apply other user-targeted policies aren't applied until the user signs intoin to the device. To verify these behaviors, be sure to create appropriate apps and policies targeted to devices and users.

Scenarios

Microsoft recommends deploying new devices as cloud-native using Microsoft Entra join. Deploying new devices as Microsoft Entra hybrid join devices isn't recommended, including through Windows Autopilot. For more information, see [Microsoft Entra joined vs. Microsoft Entra hybrid joined in cloud-native endpoints: Which option is right for your organization](/en-us/intune/solutions/cloud-native-endpoints/azure-ad-joined-hybrid-azure-ad-joined#which-option-is-right-for-your-organization).

Each of these scenarios consists of two parts, a technician flow and a user flow.flow. At a high level, these parts are the same for Microsoft Entra join and Microsoft Entra hybrid join. The differences are primarily seen by the end user in the authentication steps.

Technician flow

After the customer or IT Adminadmin targets all the apps and settings they want for their devices through Intune, the pre-provisioning technician can begin the pre-provisioning process. The technician couldcan be a member of the IT staff, a services partner, or an OEM - eacha manufacturer. Each organization can decide who should perform these activities. Regardless of the scenario, the process done by the technician is the same:

  • Boot the device.

  • From the first out-of-box experience (OOBE) screen (which couldscreen, which can be a language selection, locale selection screen, or the Microsoft Entra sign-in page),page, don't select Next. Instead, press the Windows key five times to view another options dialog. From that screen, select the Windows Autopilot provisioning option and then select Continue.

  • On the Windows Autopilot Configuration screen, it displays the following information about the device:

    • The Windows Autopilot profile assigned to the device.
    • The organization name for the device.
    • The user assigned to the device (ifdevice, if there's one).one.
    • A QR code containingthat contains a unique identifier for the device. ThisUse this code can be used to look up the device in Intune, which you might be neededneed to make configuration changes. For example, assign a user or add the device to groups needed for app or policy targeting.

  • Validate the information displayed. If you need any changes are needed,changes, make the changes, and then select Refresh to redownload the updated Windows Autopilot profile details.

  • Select Provision to begin the provisioning process.

If the pre-provisioning process completes successfully:

  • A success status screen appears with information about the device, including the same details presented previously. For example, Windows Autopilot profile, organization name, assigned user, and QR code. The elapsed time for the pre-provisioning steps is also provided.
  • Select Reseal to shut down the device. At that point, you can ship the device can be shipped to the end user.

Note

Technician flow inherits behavior from self-deploying mode. Self-Deploying Mode uses the Enrollment Status Page to hold the device in a provisioning state. The device being in a provisioning state prevents the user from proceeding to the desktop after enrollment but before software and configuration are done applying. As such, if the Enrollment Status Page is disabled, the reseal button can appear before software and configuration is done applying. This behavior can allow proceeding to the user flow before the technician flow provisioning is complete. The success screen validates that enrollment was successful, not that the technician flow is necessarily complete.

If the pre-provisioning process fails:

  • An error status screen appears with information about the device, including the same details presented previously. For example, Windows Autopilot profile, organization name, assigned user, and QR code. The elapsed time for the pre-provisioning steps is also provided.
  • DiagnosticYou can gather diagnostic logs can be gathered from the device, and then it can be reset to start the process over again.

User flow

Important

  • Wait at least 90 minutes after running the Techniciantechnician flow before runningyou run the Useruser flow. Waiting makes sureensures tokens are refreshedrefresh properly between the Techniciantechnician flow and the Useruser flow. This scenario mainly affects lab and testing scenarios when you run the Useruser flow is run within 90 minutes after the Techniciantechnician flow completes.finishes.

  • The UserRun the user flow should be run within six months after the Techniciantechnician flow finishes. Waiting more than six months can cause the certificates used by the Intune Management Engine (IME) to no longer be valid leadingvalid, which leads to errors such as:

    Error code: [Win32App][DetectionActionHandler] Detection for policy with id: <policy_id> resulted in action status: Failed and detection state: NotComputed.

  • Compliance in Microsoft Entra ID is reset during the Useruser flow. Devices might show as compliant in Microsoft Entra ID after the Techniciantechnician flow completes, but then show as noncompliant once the Useruser flow starts. Allow enough time after the Useruser flow completes for compliance to reevaluate and update.

If the pre-provisioning process completedfinishes successfully and the device wasis resealed, deliver the device to the end user. The end user completes the normal Windows Autopilot user-driven process by following these steps:

  • Power on the device.

  • Select the appropriate language, locale, and keyboard layout.

  • Connect to a network (ifnetwork, if using Wi-Fi).Fi. Internet access is always required. If using Microsoft Entra hybrid join, there must also be connectivity to a domain controller.

  • If using Microsoft Entra join, on the branded sign-onin screen, enter the user's Microsoft Entra credentials.

  • If using Microsoft Entra hybrid join, the device will reboot; afterrestarts. After the reboot,restart, enter the user's Active Directory credentials.

    Note

    In certain circumstances, Microsoft Entra credentials might also be prompted for during a Microsoft Entra hybrid join scenario. For example, if Active Directory Federation Service (ADFS) isn't being used.

  • More policies and apps are delivered to the device, aswith progress tracked by the Enrollment Status Page (ESP). OnceWhen complete, the user can access the desktop.

The device ESP reruns during the user flow so that both device and user ESP run when the user logssigns in. This behavior allows the ESP to install other policies that are assigned to the device after the device completesfinishes the technician phase.

Note

If you disable the Microsoft Account Sign-In Assistant (wlidsvc) is disabled during the Technician Flow,technician flow, the Microsoft Entra sign-in option might not show. Instead, users are asked to accept the EULA,EULA and create a local account, which might not be the desired behavior.

Deploying a device

For more information onabout starting a deployment on a device when using Windows Autopilot for pre-provisioned,provisioned devices, see the Techniciantechnician flow and Useruser flow steps ofin the Windows Autopilot for pre-provisioned deployment tutorials:

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…