Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Windows Autopilot User-Driven Mode | Microsoft Learn

5 November 2026Doc update+52 / −53 lines

In brief

The page was edited for clearer setup wording, corrected ADFS known-issue text, updated metadata, standardized links, and removal of two detailed OOBE process steps.

What Intune admins need to know

Use the refreshed article for current user-driven Autopilot setup guidance and references.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

permissioned-type: public uhfHeaderId: MSDocsHeader-Windows description: With Windows Autopilot user-driven mode, devices can be configured to deploy to a ready-to-use state without requiring help from IT personnel. ms.date: 2025-06-13T00:2026-10-28T00:00:00.0000000Z ms.collection:

  • M365-modern-desktop ms.topic: how-to locale: en-us document_id: 01620937-fd7d-5214-5a2b-5173f3183e88

Windows Autopilot User-Driven Mode | Microsoft Learn

Windows Autopilot user-driven mode letsconfigures a new Windows device to be configured to automatically transform themand transforms it from theirits factory state to a ready-to-use state. This process doesnIT personnel don't require that IT personnelneed to touch the device.

The process is simple. Devices can be shippedShip or distributeddistribute devices to the end user directly with the following instructions:

  1. Unbox the device, plug it in, and turn it on.
  2. If itthe device uses multiple languages, select a language, locale, and keyboard.
  3. Connect itthe device to a wireless or wired network with internet access. If using wireless, first connect to the wi-fiWi-Fi network.
  4. Specify an e-mailemail address account and password for the organization.

The rest of the process is automated. The device doescompletes the following steps:

  1. Join the organization.
  2. Enroll in Microsoft Intune or another mobile device management (MDM) service.
  3. Get configured as defined by the organization.

OtherYou can suppress other prompts can be suppressed during the out-of-box experience (OOBE). For more information onabout the available options, see Configure Windows Autopilot profiles.

Important

If you use Active Directory Federation Services (ADFS) is being used, there's, a known issue that can enable the end user to sign in with a different account than the one assigned to that device.

Windows Autopilot user-driven mode supports Microsoft Entra join and Microsoft Entra hybrid joined devices. For more information about these two join options, see the following articles:

The steps of the user-driven process are as follows:

  1. After the device connects to a network, the deviceit downloads a Windows Autopilot profile. The profile defines the settings used for the device. For example, defineit defines the prompts suppressed during OOBE.
  2. Windows checks for critical OOBE updates. If updates are available, they're automatically installed.Windows installs them. If necessary, the device restarts.
  3. The user is prompted for Microsoft Entra credentials. This customized user experience shows the Microsoft Entra tenant name, logo, and sign-in text.
  4. The device joins Microsoft Entra ID or Active Directory, depending on the Windows Autopilot profile settings.
  5. The device enrolls to Intune or another configured MDM service. Depending on the organizational needs, this enrollment occurs either:
    • During the Microsoft Entra join process, using MDM auto-enrollment.
    • Before the Active Directory-join process.
  6. If configured, it displays the enrollment status page (ESP).
  7. After the device configuration tasks complete, the user is signed in to Windows by using the credentials they previously provided. If the device restarts during the device ESP process, the user must reenter their credentials. These details don't persist after restart.
  8. After sign-in, the enrollment status page displays for user-targeted configuration tasks.

If any issues are found during this process,occur, see Troubleshooting Windows Autopilot overview.

For more information onabout the available join options, see the following sections:

  • Microsoft Entra join is available if devices don't need to join an on-premises Active Directory domain.
  • Microsoft Entra hybrid join is available for devices that need to join both Microsoft Entra ID and the on-premises Active Directory domain.

User-driven mode for Microsoft Entra join

To complete a user-driven deployment by using Windows Autopilot, follow these preparation steps:

  1. Make sureEnsure that the users performing user-driven mode deployments can join devices to Microsoft Entra ID. For more information, see Configure device settings in the Microsoft Entra documentation.

  2. Create a Windows Autopilot profile for user-driven mode with the desired settings.

    • In Intune, explicitly choose this mode is explicitly chosen when you create a profile is created.profile.
    • In Microsoft Store for Business and Partner Center, user-driven mode is the default.

  3. If you're using Intune, create a device group in Microsoft Entra ID, and assign the Windows Autopilot profile to that group.

For each device that is deployedyou deploy by using user-driven deployment, follow these extra steps are needed:steps:

  • Add the device to Windows Autopilot. ThisYou can complete this step can be done in two ways:

  • Assign a Windows Autopilot profile to the device:

    • If usingyou use Intune and Microsoft Entra dynamic device groups, this assignment can be done automatically.
    • If usingyou use Intune and Microsoft Entra static device groups, manually add the device to the device group.
    • If usingyou use other methods, like Microsoft Store for Business or Partner Center, manually assign a Windows Autopilot profile to the device.

Tip

If the intended end-end state of the device is co-management, configure device enrollment can be configured in Intune to enable co-management, whichmanagement. This configuration happens during the Windows Autopilot process. This behavior directs the workload authority in an orchestrated manner between Configuration Manager and Intune. For more information, see How to enroll with Windows Autopilot.

User-driven mode for Microsoft Entra hybrid join

Important

Microsoft recommends deployingWe recommend you deploy new devices as cloud-native using Microsoft Entra join. DeployingWe don't recommend deploying new devices as Microsoft Entra hybrid join devices isn't recommended,devices, including through Windows Autopilot. For more information, see Microsoft Entra joined vs. Microsoft Entra hybrid joined in cloud-native endpoints: Which option is right for your organization.

Windows Autopilot requires that devices be Microsoft Entra joined. For an on-premises Active Directory environment, devices can be joined to the on-premises domain. To join the devices, configure Windows Autopilot devices to be hybrid-joined to Microsoft Entra ID.

Tip

As Microsoft talkswe talk with customers that are usingwho use Microsoft Intune and Microsoft Configuration Manager to deploy, manage, and secure their client devices, we often get questions regarding co-managing devices and Microsoft Entra hybrid joined devices. Many customers confuse these two topics. Co-management is a management option, while Microsoft Entra ID is an identity option. For more information, see Understanding hybrid Microsoft Entra and co-management scenarios. This blog post aims to clarify Microsoft Entra hybrid join and co-management, how they work together, but aren't the same thing.

TheYou can't deploy the Configuration Manager client can't be deployed while provisioning a new computer in Windows Autopilot user-driven mode for Microsoft Entra hybrid join. This limitation is due to the identity change of the device during the Microsoft Entra join process. Deploy the Configuration Manager client after the Windows Autopilot process. See Client installation methods in Configuration Manager for alternative options for installing the client.

Requirements for user-driven mode with hybrid Microsoft Entra ID

  • Create a Windows Autopilot profile for user-driven mode.

    In the Windows Autopilot profile, under Join to Microsoft Entra ID as, select Microsoft Entra hybrid joined.

  • If usingyou use Intune, create a device group is needed in Microsoft Entra ID. Assign the Windows Autopilot profile to the group.

  • If usingyou use Intune, create and assign a Domain Join profile. A Domain Join configuration profile includes on-premises Active Directory domain information.

  • The device needs to access the internet.internet access. For more information, see the networking requirements.

  • Install the Intune Connector for Active Directory.

    Note

    The Intune Connector for Active Directory joins the device to the on-premises domain. Users don't need permissions to join devices to the on-premises domain. This behavior assumes that the connector is configured for this action on the user's behalf. For more information, see Increase the computer account limit in the Organizational Unit (OU).

  • If usingyou use a proxy, enable and configure the Web Proxy Auto-Discovery Protocol (WPAD) Proxy settings option.

In addition to these core requirements for user-driven Microsoft Entra hybrid join, the following extra requirements apply to on-premises devices:

  • The device has a currently supported version of Windows.
  • The device is connected to the internal network and has access to an Active Directory domain controller.

User-driven mode for Microsoft Entra hybrid join with VPN support

Devices joined to Active Directory requireneed connectivity to an Active Directory domain controller for many activities. These activities include validating the user's credentials when they sign-in,sign in and applying group policy settings. The Windows Autopilot user-driven process for Microsoft Entra hybrid joined devices validateschecks that the device can contact a domain controller by pinging that domain controller.

With the addition ofBy adding VPN support for this scenario, you can configure the Microsoft Entra hybrid join process can be configured to skip the connectivity check. This change doesn't eliminate the need for communicating with a domain controller. Instead, Intune delivers the needed VPN configuration to allow connection to the organization's network, Intune delivers the needed VPN configurationnetwork before the user attempts to sign in to Windows.

Requirements for user-driven mode with hybrid Microsoft Entra ID and VPN

- Can be deployed with Intune, and lets the user manually establish a VPN connection from the Windows sign-in screen.
- Automatically establishes a VPN connection as needed.

The specific VPN configuration requiredyou need depends on the VPN software and authentication being used.you use. For non-Microsoft VPN solutions, this configuration typically involves deploying a Win32 app viaby using Intune Management Extensions. This app would includeincludes the VPN client software and any specific connection information. For example,information, such as VPN endpoint host names. For configuration details specific to that provider, see the VPN provider's documentation.

Note

The VPN requirements aren't specific to Windows Autopilot. For example, if you implement a VPN configuration is implemented to enable remote password resets, you can use that same configuration can be used with Windows Autopilot. This configuration would allowallows a user to sign in to Windows with a new password when not on the organization's network. OnceAfter the user signs in and their credentials are cached, subsequent sign-in attempts don't need connectivity since Windows uses the cached credentials.

If the VPN software requires certificate authentication, use Intune to also deploy the required device certificate. This deploymentYou can be donedeploy this certificate by using the Intune certificate enrollment capabilities,capabilities and targeting the certificate profiles to the device.

Some configurations aren't supported because they arendon't appliedapply until the user signs intoin to Windows:

  • User certificates
  • Non-Microsoft UWP VPN plug-ins from the Windows Store

Validation

Before attemptingyou attempt a Microsoft Entra hybrid join by using VPN, it's important to confirm that the user-driven mode for Microsoft Entra hybrid join process works on the internal network. This test simplifies troubleshooting by making sureensuring the core process works before adding the VPN configuration.

Next, confirm Intuneyou can be useduse Intune to deploy the VPN configuration and its requirements. Test these components with an existing device that's already Microsoft Entra hybrid joined. For example, some VPN clients create a per-machine VPN connection as part of the installation process. Validate the configuration by using the following steps:

  1. Verify that you create at least one per-machine VPN connection is created.connection.

    Get-VpnConnection -AllUserConnection
RASDIAL.EXE "ConnectionName"

  2. Sign out of Windows. Verify that the VPN connection icon appears on the Windows sign-in page.

  3. Move the device off the internal network and try to establish the connection by using the icon on the Windows sign-in page. Sign in to an account that doesn't have cached credentials.

For VPN configurations that automatically connect, the validation steps might be different.

Note

An\ No newline at end of file You can use an always-on VPN can be used for this scenario. For more information, see Deploy always-on VPN. \ No newline at end of file \ No newline at end of file

Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…