Daily Intune News
Aboutmerill.net
Windows Autopilot
Device enrollment

Windows Autopilot for Existing Devices | Microsoft Learn

9 November 2026Doc update+64 / −62 lines

In brief

The page received wording, capitalization, metadata, and structure updates. Enrollment Status Page setup now separates Windows selection from the Windows Autopilot > Enrollment Status Page navigation, and the previous automatic-enrollment step is no longer included.

What Intune admins need to know

Administrators should use the revised navigation when consulting the ESP setup instructions.

This summary was assembled from the tracked documentation change. Verify important details in the full Microsoft Learn article.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

Windows Autopilot for existing devicesExisting Devices | Microsoft Learn

Modern desktop deployment with Windows Autopilot helps you easily deploy the latest version of Windows to existing devices. AppsThe process can automatically install apps used by the organization can be automatically installed.your organization. If you manage Windows user data is managed with OneDrive for work or school, data is synchronized,synchronizes so users can resume working right away.

Windows Autopilot for existing devices allows reimagingyou to reimage and provisioningprovision a Windows device for Windows Autopilot user-driven mode by using a single, native Configuration Manager task sequence. The existing device can be on-premises domain-joined. The end result is a Windows device joined tothat is either Microsoft Entra IDjoined or Active Directory (MicrosoftMicrosoft Entra hybrid join).joined.

Note

The JSON file for Windows Autopilot for existing devices only supports user-driven Microsoft Entra ID and user-driven hybrid Microsoft Entra Windows Autopilot profiles. Self-deploying and pre-provisioning Windows Autopilot profiles aren't supported with JSON files due tobecause these scenarios requiringrequire TPM attestation.

However, during the Windows Autopilot for existing devices deployment, if the following conditions are true:

  • Device is already a Windows Autopilot device before the deployment begins
  • Device has a Windows Autopilot profile assigned to it

then the assigned Windows Autopilot profile takes precedence over the JSON file installed by the task sequence. In this scenario, if the assigned Windows Autopilot profile is either a self-deploying or pre-provisioning Windows Autopilot profile, then the self-deploying and pre-provisioning scenarios are supported.

Tip

UsingYou can use Windows Autopilot for existing devices could be used as a method to convert existing hybrid Microsoft Entra devices into Microsoft Entra devices. Using the setting Convert all targeted devices to Autopilot in the Windows Autopilot profile doesn't automatically convert existing hybrid Microsoft Entra devicedevices in the assigned groups into a Microsoft Entra device.devices. The setting only registers the devices in the assigned groups for the Windows Autopilot service.

Requirements

Important

Any devices registered by using a .json file during a hybrid join scenario are normally enrolled as a Corporate device.

Configure the Enrollment Status Page (optional)

If desired, set up an enrollment status page (ESP) for Windows Autopilot can be set upby using Intune.

  1. Open the Microsoft Intune admin center.
  2. Go to Devices > Device onboarding | Enrollment. Make sureEnsure Windows is selected at the top and then undertop.
  3. Under Windows Autopilot, select Enrollment Status Page and Set up the Enrollment Status Page.
  4. Go to Microsoft Entra ID > Manage | Mobility (MDM and WIP) > Microsoft Intune and enable Windows automatic enrollment. Configure the MDM user scope for some or all users.

Install required modules

```

  1. Enter the following commands and provide Intune administrative credentials:

    Make sureEnsure the specified user account has sufficient administrative rights.

    Connect-MgGraph -Scopes "Device.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All", "Domain.ReadWrite.All", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.Read"

    Windows requests the username and password for the account withby using a standard Microsoft Entra ID form. Type the username and password, and then select Sign in.

    Screenshot shows the Windows form to sign in to a Microsoft Entra account.

    The first time you use Intune Graph APIs are used on a device, it promptsthey prompt you to enable Microsoft Intune PowerShell read and write permissions. To enable these permissions, select Consent on behalf orof your organization and then Accept.

Get Windows Autopilot profiles for existing devices

Property Type Required Description
Version Number Optional The version number that identifies the format of the JSON file.
CloudAssignedTenantId GUID Required The Microsoft Entra tenant ID that should be used. This property is the GUID for the tenant, and you can be foundfind it in the properties of the tenant. The value shouldn't include braces.
CloudAssignedTenantDomain String Required The Microsoft Entra tenant name that should be used. For example: tenant.onmicrosoft.com.
CloudAssignedOobeConfig Number Required This property is a bitmap that shows which Windows Autopilot settings were configured.
- 1: SkipCortanaOptIn
- 2: OobeUserNotLocalAdmin
- 4: SkipExpressSettings
- 8: SkipOemRegistration
- 16: SkipEula
CloudAssignedDomainJoinMethod Number Required This property specifies whether the device should join Microsoft Entra ID or Active Directory (Microsoft Entra hybrid join).
- 0: Microsoft Entra joined
- 1: Microsoft Entra hybrid joined
CloudAssignedForcedEnrollment Number Required Specifies that the device should require Microsoft Entra join and MDM enrollment.
- 0: Not required
- 1: required
ZtdCorrelationId GUID Required A unique GUID (without braces) provided to Intune as part of the registration process. This ID is included in the enrollment message as the OfflineAutopilotEnrollmentCorrelator. This attribute is present only if enrollment happens on a device registered with Zero Touch Provisioning viaby using offline registration.
CloudAssignedAadServerData Encoded JSON string Required An embedded JSON string used for branding. It requires enabling Microsoft Entra organization branding. For example:"CloudAssignedAadServerData": "{\"ZeroTouchConfig\":{\"CloudAssignedTenantUpn\":\"\",\"CloudAssignedTenantDomain\":\"tenant.onmicrosoft.com\"}}
CloudAssignedDeviceName String Optional The name automatically assigned to the computer. This name follows the naming pattern convention configured in the Intune Windows Autopilot profile. An explicit nameYou can also be specified.specify an explicit name.

Create the JSON file

Save the Windows Autopilot profile as a JSON file in ASCII or ANSI format. Windows PowerShell defaults to Unicode format. If redirectingyou redirect output of the commands to a file, also specify the file format. The following PowerShell example saves the file in ASCII format.

The Windows Autopilot profiles appear in a subfolder under the folder specified by the $targetDirectory variable. By default, the $targetDirectory variable is C:\AutoPilot, but ityou can be changedchange it to another location if desired.location. The subfolder hasfolder uses the name of the Windows Autopilot profile from Intune. If there are multiple Windows Autopilot profiles, each profile has its own subfolder. In each folder, there's a JSON file named AutopilotConfigurationFile.json.

Connect-MgGraph -Scopes "Device.ReadWrite.All", "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementServiceConfig.ReadWrite.All", "Domain.ReadWrite.All", "Group.ReadWrite.All", "GroupMember.ReadWrite.All", "User.Read"

Tip

When you use the PowerShell cmdlet **Out-File** is used to redirect the JSON output to a file, it uses Unicode encoding by default. This cmdlet might also truncate long lines. Use the **Set-Content** cmdlet with the `-Encoding ASCII` parameter to set the proper text encoding.

Important

The file name has tomust be `AutopilotConfigurationFile.json` and encoded as ASCII or ANSI.

The profileYou can also be savedsave the profile to a text file and edit it in Notepad. In Notepad, when choosingyou choose **Save as**, select the save as type: **All Files**, and then select **ANSI** for the **Encoding**.

![SaveScreenshot shows the option to save as ANSI encoding in Notepad.](images/notepad.png)

After savingyou save the file, move it to a location for a Microsoft Configuration Manager package source.

Important

The configuration file can only contain one profile. MultipleYou can use multiple JSON profile files can be used,files, but each one must be named `AutopilotConfigurationFile.json`. This requirement is for OOBE to follow the Windows Autopilot experience. To use more than one Windows Autopilot profile, create separate Configuration Manager packages.

Windows OOBE doesn't follow the Windows Autopilot experience if you save the file is saved with one of the following criteria:

- Unicode encoding.encoding
- UTF-8 encoding.encoding
- A file name other than `AutopilotConfigurationFile.json`.

## Create a package containing the JSON file

    - *Source folder*: Specify the UNC network path that contains the `AutopilotConfigurationFile.json` file

    For more information, see [Packages and programs in Configuration Manager](/en-us/intune/configmgr/apps/deploy-use/packages-and-programs).
4. For the program, select the *Program Type*: **Don't create a program**.
5. Complete the wizard.

Note

If you change the user-driven Windows Autopilot profile settings in Intune are changed at a later date, make sure toIntune, recreate and update the JSON file. After updating the JSON file, redistribute the associated Configuration Manager package.

## Create a target collection

1. In the Configuration Manager console, go to the **Assets and Compliance** workspace, and select the **Device Collections** node.
2. On the ribbon, select **Create**, and then select **Create Device Collection**. An existing collectionYou can also be used.use an existing collection. If usingyou use an existing collection, proceed to the Create a task sequence section.
3. In the Create Device Collection Wizard, enter the following **General** details:

    - *Name*: **Windows Autopilot for existing devices collection**
    - *Limiting collection*: **All Systems** or if desired, an alternate collection.
4. On the **Membership Rules** page, select **Add Rule**. Specify either a direct or query-based collection rule to add the target Windows devices to the new collection.

    For example, if the hostname of the computer to be wipedwipe and reloadedreload is `PC-01`, and **Name** is being used as the attribute:

    1. Select **Add Rule**, select **Direct Rule** to open the Create Direct Membership Rule Wizard, and select **Next** on the Welcome page.
    2. On the **Search for Resources** page, enter **PC-01** as the **Value**.

## Create a task sequence

1. In the Configuration Manager console, go to the **Software Library** workspace, expand **Operating Systems**, and select the **Task Sequences** node.
2. In the **Home** ribbon, select **Create Task Sequence**.
3. In the **Create new task sequence** page,, select the option to **Deploy Windows Autopilot for existing devices**.
4. In the **Task sequence information** page,, specify the following information:

    - A name for the task sequence. For example, **Windows Autopilot for existing devices**.
    - Optionally add a description to better describe the task sequence.
    - Select a boot image. For more information on supported boot image versions, see [Support for the Windows ADK in Configuration Manager](/en-us/intune/configmgr/core/plan-design/configs/support-for-windows-adk).
5. In the **Install Windows** page,, select the Windows **Image package**. Then configure the following settings:

    - **Image index**: Select either Enterprise, Education, or Professional, as required by the organization.
    - Enable the option to **Partition and format the target computer before installing the operating system**.
    - **Configure task sequence for use with Bitlocker**: If you enable this option is enabled,option, the task sequence includes the steps necessary to enable BitLocker.
    - **Product key**: If you need to specify a product key needs to be specified for Windows activation, enter it here.
    - Select one of the following options to configure the local administrator account in Windows:

        - **Randomly generate the local administrator password and disable the account on all support platforms (recommended)**
        - **Enable the account and specify the local administrator password**
6. In the **Install the Configuration Manager client** page,, add any necessary Configuration Manager client installation properties for the environment.

    For example, since the device is a Workgroupworkgroup device and not domain joined during the Windows Autopilot for existing devices task sequence, you might need the [SMSMP](/en-us/intune/configmgr/core/clients/deploy/about-client-installation-properties#smsmp) or [SMSMPLIST](/en-us/intune/configmgr/core/clients/deploy/about-client-installation-properties#smsmplist) parameters might be needed to run certain tasks such as the **Install Application** or **Install Software Updates** tasks.
7. TheIn **Include updates** page selects by default, select the option to **Do not install any software updates**.
8. In the **Install applications** page,, optionally select applications to install during the task sequence can be selected.sequence. However, Microsoft recommends that to mirror the signature image approach with this scenario. After the device provisions with Windows Autopilot, applyscenario, Microsoft recommends applying all applications and configurations from Microsoft Intune or Configuration Manager co-management.management after the device provisions with Windows Autopilot. This process provides a consistent experience between users receiving new devices and those using Windows Autopilot for existing devices.
9. In the **System Preparation** page,, select the package that includes the Windows Autopilot configuration file. By default, the task sequence restarts the computer after it runs Windows Sysprep. TheYou can also select the option to **Shutdown computer after this task sequence completes** can also be selected.. This option allows preparation ofyou to prepare a device and then deliverydeliver it to a user for a consistent Windows Autopilot experience.
10. Complete the wizard.

The Windows Autopilot for existing devices task sequence results in a device joined to Microsoft Entra ID.

Note

For Windows Autopilot for existing devices task sequence, the **Create Task Sequence Wizard** purposely skips configuring and adding the **Apply Network Settings** task. If you don't specify the **Apply Network Settings** task isn't specified in a task sequence, it uses Windows default behavior, which is to join a workgroup.

The Windows Autopilot for existing devices task sequence runs the **Prepare Windows for capture** step, which uses the Windows System Preparation Tool (Sysprep). If the device is joined to a domain, Sysprep fails, so therefore the Windows Autopilot for existing devices task sequence joins a workgroup. For this reason, it isn't necessary to add the **Apply Network Settings** task to a Windows Autopilot for existing devices task sequence.

For more information on creating the task sequence, including information on other wizard options, see [Create a task sequence to install an OS](/en-us/intune/configmgr/osd/deploy-use/create-a-task-sequence-to-install-an-operating-system).

If you view the task sequence is viewed,sequence, it's similar to the default task sequence to apply an existing OS image. This task sequence includes the following extra steps:

- **Apply Windows Autopilot configuration**: This step applies the Windows Autopilot configuration file from the specified package. It's not a new type of step, itstep. It's a **Run Command Line** step to copy the file.
- **Prepare Windows for Capture**: This step runs Windows Sysprep, and has the setting to **Shutdown the computer after running this action**. For more information, see [Prepare Windows for Capture](/en-us/intune/configmgr/osd/understand/task-sequence-steps#prepare-windows-for-capture).

For more information on editing the task sequence, see [Use the task sequence editor](/en-us/intune/configmgr/osd/understand/task-sequence-editor) and [Task sequence steps](/en-us/intune/configmgr/osd/understand/task-sequence-steps).

The **Prepare Windows for Capture** step deletes the `AutopilotConfigurationFile.json` file. For more information and a workaround, see [Modify the task sequence to account for Sysprep command line configuration](tutorial/existing-devices/create-autopilot-task-sequence#modify-the-task-sequence-to-account-for-sysprep-command-line-configuration) and [Windows Autopilot - known issues: Windows Autopilot for existing devices doesn't work](known-issues#windows-autopilot-for-existing-devices-doesnt-work).

To make sureensure the user's data is backed up before the Windows upgrade, use OneDrive for work or school [known folder move](/en-us/onedrive/redirect-known-folders).

## Distribute content to distribution points

NextNext, distribute all content required for the task sequence to distribution points.

1. Select the **Windows Autopilot for existing devices** task sequence, and insequence. In the ribbonribbon, select **Distribute Content**.
2. On the **Specify the content destination** page, select **Add** to specify either a **Distribution Point** or **Distribution Point Group**.
3. Specify content destinations that let the devices get the content.
4. After specifying content distribution, complete the wizard.

## Deploy the Windows Autopilot task sequence

1. Select the **Windows Autopilot for existing devices** task sequence, and insequence. In the ribbonribbon, select **Deploy**.
2. In the Deploy Software Wizard, specify the following details:

    - **General**

            Note

            Select the option here that is's relevant for the context of testing. If the target client doesn't have the Configuration Manager agent or Windows installed, you need to start the task sequence needs to be started viaby using PXE or Boot Media.
    - **Scheduling**

        - Set a time for when this deployment becomes availableavailable.
    - **User Experience**

        - Select **Show Task Sequence progress**.
    - **Distribution Points**

        - *Deployment options*: **Download content locally when needed by the running task sequence**.
3. Complete the wizard.

## Complete the deployment process

Note

If devices need to be joined to Active Directory as part of a Microsoft Entra hybrid join scenario, don't do so throughuse the task sequence and the **Apply Network Settings** Task.task. Instead, create a **Domain Join** device configuration profile. SinceBecause there's no Microsoft Entra device object for the computer to do group-based targeting, target the profile to **All Devices**. For more information, see [User-driven mode for Microsoft Entra hybrid join](user-driven#user-driven-mode-for-microsoft-entra-hybrid-join).

## Register the device for Windows Autopilot


## Tutorial

\ No newline at end of file
For a detailed tutorial on configuring Windows Autopilot for existing devices, see the following article: [Step by step tutorial for Windows Autopilot deployment for existing devices in Intune and Configuration Manager](tutorial/existing-devices/existing-devices-workflow)
\ No newline at end of file.
\ No newline at end of file
Daily Intune.Admin.News

Get daily email updates

Get a concise summary of the latest Microsoft Intune updates delivered straight to your inbox.

Loading the secure signup form…