Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Software

5 November 2026Doc update+70 / −71 lines

In brief

The page received metadata, wording, and formatting updates. RSS guidance and requirement labels were rephrased, while the listed Windows 11 versions and KB references were reformatted.

What Intune admins need to know

Use the updated page when reviewing device preparation prerequisites; no administrator action is indicated.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

permissioned-type: public uhfHeaderId: MSDocsHeader-Windows description: Software, Networking, Licensing, Configuration, and RBAC requirements for Windows Autopilot device preparation. ms.date: 2025-06-11T00:2026-10-28T00:00:00.0000000Z ms.collection:

  • M365-modern-desktop ms.topic: article ms.custom:

    • CI 116757

    Tip

    Use RSS can be used to notifyget notified when requirements are added or updated to this page.article is updated. For example, the following RSS link includes this article:

    https://learn.microsoft.com/api/search/rss?search=%22Software%2C+Networking%2C+Licensing%2C+Configuration%2C+and+RBAC+requirements+for+Windows+Autopilot+device%22&locale=en-us&%24filter=

    This example includes the &locale=en-us variable. The locale variable is required, but you can change it can be changedto another supported locale. For example, &locale=es-es.

    For more information onabout using RSS for notifications, see How to use the docs in the Intune documentation.

    The list of requirements for Windows Autopilot device preparation is organized into five different categories:

    • Software - OS requirements.: operating system requirements
    • Networking -: networking requirements.requirements
    • Licensing -: licensing requirements.requirements
    • Configuration -: configurations required in Microsoft Entra ID and Microsoft Intune.Intune
    • RBAC -: RBAC permissions required for a Windows Autopilot device preparation administrator.administrator

    Select the appropriate tab to see the relevant requirements:

    Software

    Software requirements

    Windows Autopilot device preparation depends on specific features available in Windows client, Microsoft Entra ID, and a mobile device management (MDM) service such as Microsoft Intune. To use Windows Autopilot device preparation and access these features, someyou must meet software requirements must be met.requirements.

    Windows 11

    • Windows 11, version 24H2 or later.
    • Windows 11, version 23H2 with KB5035942 or later -later, Windows 11, version 23H2 installation media dated April 2024 or later has KB5035942 included.
    • Windows 11, version 22H2 with KB5035942 or later -later, Windows 11, version 22H2 installation media dated April 2024 or later has KB5035942 included.

    Important

    Windows 365 Cloud PCs

    • Windows 11, version 24H2 with KB5052093 or later -later. The Windows 11, version 24H2 images in the Windows 365 image gallery are updated with the latest updates, including KB5052093. However when creatingWhen you create custom images, make sure to use Windows 11, version 24H2 installation media dated March 2025 or later which has KB5052093 included.
    • Windows 11, version 23H2 with KB5035942 or later -later. The Windows 11, version 23H2 images in the Windows 365 image gallery are updated with the latest updates, including KB5035942. However when creatingWhen you create custom images, make sure to use Windows 11, version 23H2 installation media dated March 2025 or later which has KB5035942 included.
    • Windows 11, version 22H2 with KB5035942 or later -later. The Windows 11, version 22H2 images in the Windows 365 image gallery are updated with the latest updates, including KB5035942. However when creatingWhen you create custom images, make sure to use Windows 11, version 22H2 installation media dated March 2025 or later which has KB5035942 included.

    The following editions are supported:

    Networking

    Networking requirements

    Windows Autopilot device preparation depends on various internet-based services. AccessYou must provide access to these services must be provided for Windows Autopilot device preparation to function properly. In the simplest case, enabling proper functionality can be achieved by ensuringensure the following conditions:

    • Ensure Domain Name Services (DNS)DNS name resolution for internet DNS names.
    • Allow accessAccess to all hosts viausing port 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP).

    Additional configurationYou might be requiredneed to configure additional settings to grant access to required services in environments that:

    • Have more restrictive internet access.
    • Require authentication before internet access can be obtained.

    Note

    Smart card and certificate based authentication isnaren't supported during the out-of-box experience (OOBE). For more information, see Smartcards and certificate-based authentication.

    Service requirements

    Windows Autopilot device preparation relies on several different typetypes of services to function properly. In orderYou might need to perform certain network configurations for these services to function properly, certain network configurations might need to be performed.properly. These services and their required network configurations are as follows:follows.

    Windows Autopilot deployment service

    After a network connection is in place, each Windows device will contactcontacts the Windows Autopilot deployment service. The following URLs are used:

    • https://login.live.com

    Microsoft Entra ID

    Microsoft Entra ID validates user credentials. Additionally,Also, the device is joined to Microsoft Entra ID during Windows Autopilot device preparation. For more information, see Office 365 IP Address and URL Web service.

    Microsoft Intune

    Once authenticated,After it authenticates, Microsoft Entra ID triggers enrollment of the device into the Intune mobile device management (MDM) service. For more information about Intune's network communication requirements, see the following articles:

    Windows Autopilot device preparation automatic device diagnostics collection

    For diagnostics to be able to upload successfully from the client, make sureensure that the URL lgmsapeweu.blob.core.windows.net isn't blocked on the network. Diagnostics are available for 28 days before they're removed.

    For more information, see Collect diagnostics from a Windows device.

    Windows Update

    During the out-of-box experience (OOBE) process and after the Windows OS configuration, the Windows Update service retrievesgets needed updates. If there are problems connecting to Windows Update, see Windows Update issues troubleshooting.

    If Windows Update is inaccessible, the Windows Autopilot device preparation process still continues but critical updates aren't available.

    Windows Autopilot device preparation contacts the Delivery Optimization service when downloading the applications and updates. This contact establishes peer-to-peer sharing of content so that only a few devices need to download it from the internet.

    • Windows Updates.Updates
    • Microsoft Store applications and application updates.updates
    • Office Updates.Updates
    • Intune Win32 Applications.Applications

    If the Delivery Optimization Service is inaccessible, the Windows Autopilot process still continues with Delivery Optimization downloads from the cloud without peer-to-peer.

    Network Time Protocol (NTP) sync

    Domain Name Services (DNS)

    To resolve internet names for all services, the device communicates with a DNS server, typically provided viaby using DHCP. This DNS server must be able to resolve internet names.

    Diagnostics data

    Diagnostic data collection is enabled by default. For more information, see Manage enterprise diagnostic data.

    If the device can't send diagnostic data, the Windows Autopilot device preparation process still continues. However, servicesServices that depend on diagnostic data don't work.

    Network Connection Status Indicator (NCSI)

    Windows must be able to tell that the device can access the internet. For more information, see Network Connection Status Indicator (NCSI).

    *.msftconnecttest.com must be resolvable via DNS and accessible viaby using HTTP.

    Windows Notification Services (WNS)

    This service is used to enable Windows to receive notifications from applications and services. For more information, see Microsoft Store.

    If the WNS services aren't available, the Windows Autopilot device preparation process still continues without notifications.

    Microsoft Store

    Applications in the Microsoft Store can be pushed to the device by triggering them viaby using Intune or otheranother MDM service. App updates and additional applications might also be needed when the user first logs in. For more information, see Update to Intune integration with the Microsoft Store on Windows and FAQ: Supporting Microsoft Store experiences on managed devices.

    If the Microsoft Store isn't accessible, the Windows Autopilot process still continues without Microsoft Store applications.

    Microsoft 365

    As part of the Intune device configuration, installation ofyou might need to install Microsoft 365 Applications for enterprise might be required.Enterprise. For a list that includes allof Office services, DNS names, IP addresses, including Microsoft Entra ID and other services that might overlap with the previously listed services, see Microsoft 365 URLs and IP address ranges.

    Certificate revocation lists (CRLs)

    Some of these services also need to check certificate revocation lists (CRLs) for certificates used in the services. For a full list, see Microsoft 365 URLs and IP address ranges and Microsoft 365 Certificate Chains.

    Proxy settings

    Deploying proxy settings for Windows Autopilot device preparation should be configured on the proxy server itself. Implementing proxy settings viaby using Intune policy isn't fully supported as itsupported. It might cause issues and unexpected behavior with privileged access deployments.

    Licensing

    Licensing requirements

    Windows Autopilot device preparation depends on specific capabilities available in Windows client and Microsoft Entra ID. It also requires a mobile device management (MDM) service such as Microsoft Intune. TheseYou can get these capabilities can be obtained through various editions and subscription programs.

    To provide the needed Microsoft Entra ID and MDM functionality, including automatic MDM enrollment and company branding features, you need one of the following subscriptions is required:subscriptions:

    Note

    When you use a Microsoft 365 subscription is used, licensessubscription, you still need to be assignedassign licenses to users so they can enroll devicedevices in Intune. For more information, see assign licenses to users so they can enroll devices in Intune.

    Additionally,We recommend the following are also recommended, but not required:resources:

    Configuration

    Configuration requirements

    Before you can use Windows Autopilot device preparation can be used, somepreparation, complete the following configuration tasks are required to support the common Windows Autopilot device preparation scenarios.

    TheWe recommend the following configurations are optional but recommended. They aren't required:configurations:

    There are no additional hardware requirements to use Windows Autopilot device preparation, beyond the hardware requirements to run Windows. For more information, see:

    RBAC

    Required RBAC permissions

    To create a custom role with these permissions for use with Windows Autopilot device preparation:

    1. Sign in to the Microsoft Intune admin center.

    2. In the Home screen, in the left pane, select Tenant administration in the left hand pane..

    3. In the Tenant admin | Tenant status screen, select Roles.

    4. In the Endpoint Manager roles | All roles screen, make sure All roles is selected under Manage.

    5. Select the Create drop down menu and then select Intune role. The Add Custom Role screen opens.

    6. In the Add Custom Role screen:

      1. In the Basics page:

        1. Name - enter. Enter a name for the custom role, such as Windows Autopilot device preparation administrator.
        2. Description - enter. Enter a description for the custom role.

      2. Select Next.

      3. In the Permissions page, under Select a category below to configure settings., scroll through the list to find the following settings. Once the setting is located,After you find a setting, expand it, and then change to the following permissions:

        • Device configurations

          • Read: Yes

          All other permissions can be left at the default of No.

      4. OnceWhen all permissions are set correctly, select Next.

      5. In the Scope tags page, select Next.

        Note

        Scope tags are optional. If you need to specify a custom scope tag needs to be specified, do so attag, add it on this page. For more information about scope tags, see Use role-based access control and scope tags for distributed IT.

      6. In the Review + create page, verify that all permissions are correct, and then select Create.

    7. TheAssign the new custom Windows Autopilot device preparation role can now be assigned to users who administer Windows Autopilot device preparation.

    For more information, see Role-based access control (RBAC) with Microsoft Intune.

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…