Windows 10 Autopilot Deployment Guide | Microsoft Intune

As per Microsoft, Windows Autopilot is a collection of technologies used to set up and pre-configure new devices, getting them ready for productive use. You can also use Windows Autopilot to reset, repurpose, and recover devices. This solution enables an IT department to achieve the above with little to no infrastructure to manage, with a process that’s easy and simple.

In this post, we will discuss about Windows 10 / Windows 11 device provision using Windows Autopilot for Azure Active Directory (AAD) joined devices.

Table of Contents

  • Configure Azure AD Automatic Enrollment
  • Configure Azure AD custom branding
  • Create a Device group for Windows Autopilot devices
  • Create Windows Autopilot Deployment Profile
  • Configure Enrollment Status Page
  • Register device with Windows Autopilot
  • Reset the VM to factory settings
  • Out of Box Experience (OOBE)

Best Windows Autopilot deployment Guide

Before you use Windows Autopilot, few configurations are required to support Autopilot scenarios.

Configure Azure Active Directory Automatic Enrollment

Automatic enrollment lets user enroll their Windows devices in Microsoft Intune. Follow the below steps to configure Automatic MDM enrollment.

  • Sign in to the Azure portal, and select Azure Active Directory > Mobility (MDM and MAM) > Microsoft Intune.
  • Configure MDM user scope. If you select Some then you need to select an Azure AD Group.

Intune - MDM Scope

Note: MDM user scope must be set to an Azure AD group that contains user objects.

Configure Azure Active Directory custom branding (Optional)

The Azure Active Directory custom branding page allow you to configure an organization specific logon page. You can add company branding to your sign-in page in Azure AD. You can configure these settings from Azure portal > Azure AD > Company branding.

Azure Active Directory - Custom Branding

Create a device group for Windows Autopilot

A device group is required to assign Windows Autopilot Deployment Profile. We will create a group with dynamic membership using Autopilot device attributes (ZTDId). This will reduce manual efforts of adding each device in group as device automatically become member of this group when hardware hash imported into Windows Autopilot.

To create a group that includes all of your Autopilot devices, use below expression in dynamic membership rule:

(device.devicePhysicalIDs -any (_ -contains “[ZTDId]”))

Intune - Dynamic Device Group

Create Windows Autopilot Deployment Profile

Autopilot deployment profiles are used to configure the Autopilot devices. A Windows Autopilot Deployment Profile need to be assigned to devices to enable Windows autopilot for them. Follow the below steps to create Autopilot deployment profile.

In the Microsoft Endpoint Manager admin center, choose Devices > Windows > Windows enrollment > Deployment Profiles

Click on Create Profile > Windows PC

Intune - Windows Autopilot Deployment Profile

On the Basics page, type a Name and optional Description. Click on Next.

Intune - Windows Autopilot Deployment Profile

On the Out-of-Box Experience (OOBE) page, we will go ahead with all default settings.

Intune - Windows Autopilot Deployment Profile - OOBE

Settings:

  • Deployment Mode : User Driven

Devices with this profile requires user enrolling the device using their Azure Active Directory credential.

  • Join to Azure AD : Azure AD joined
  • Microsoft Software License Terms : Hide
  • Privacy Settings : Hide
  • Hide change account options : Hide
  • User Account type : Standard
  • Allow White Glove OOBE : No
  • Language (Region) : Operating System default
  • Automatically Configure keyboard : Yes
  • Apply device name template : Yes

On the Assignment page, add the AAD group you created for Windows Autopilot Devices and click on Next.

Intune - Windows Autopilot Deployment Profile - Assignment

On the Review + create page, review the details and click on Create.

Intune - Windows Autopilot Deployment Profile - Create + review

The Autopilot deployment profile is now created and you see the same from Devices > Windows Enrollment > Windows Autopilot Deployment Profile.

Intune - Windows Autopilot Profile list

Configure Enrollment Status Page

The Enrollment Status Page (ESP) shows the progress of device provisioning when a new device enrolled to Intune or a new user sign in to the device. You can show ESP during the default out-of-box experience (OOBE) for Azure AD join, Windows Autopilot scenarios or when new user sign into the device for the first time.

Check out this post for step by step guide to configure Enrollment Status Page.

Manually Register Device with Windows Autopilot

We have configured all required settings in Intune to support Windows autopilot scenarios. Now we need to manually register device to Windows Autopilot to go ahead with our testing. The manual registration process is primarily for testing purpose. An organization should opt for OEMs or CSP partners for Windows Autopilot registration. An OEM or other device provider uses the registration authorization process to perform device registration on your behalf.

Follow the below steps to register device to Windows Autopilot.

  • Install Windows 10 on a test device or VM. We will use same device for Autopilot deployment.
  • Download PowerShell script (Get-WindowsAutoPilotInfo.ps1) from PowerShell gallery to get a device’s hardware hash and serial number. The serial number is useful for quickly seeing which device the hardware hash belongs to.
  • Run the Powershell script on test device which you prepared for Windows Autopilot deployment testing.

Windows Autopilot - Capture hardware hash

Once we done with capturing hardware hash in CSV file the same need to be uploaded to Windows Autopilot. We will use Microsoft Intune to import the device to Windows Autopilot.

In the Microsoft Endpoint Manager admin center, choose Devices > Windows > Windows enrollment and select Devices in Windows Autopilot Deployment Program section

Intune - Windows Autopilot devices

On the next screen, click on Import

Intune - Windows Autopilot devices

On the Add Autopilot devices screen, click on Browse button and select the hardware hash CSV file. Click on Import.

Intune - Windows Autopilot devices - Import

You can see status of import in Notification area.

Intune - Console Notification

If Import was successful then you will see the device details in Windows Autopilot Devices page.

Intune - Windows Autopilot Devices - List

Reset the VM to factory settings

Now we need to reset the Windows 10 VM to factory settings. This will force the device to go to Windows setup OOBE stage. The Windows Autopilot profile will get downloaded at this stage automatically.

Before reset , you need to ensure that machine is connected with network and Internet is accessible.

Perform below steps to reset your Windows OS to factory settings.

  • From Start Menu , select Settings
  • In Windows Settings window select Update & Security
  • In Windows Update window select Recovery from left pane

You will now see Recovery page. Click on Get started under Reset this PC to begin reset process.

Windows 10 – Reset

On the Choose an option page, select Remove everything.

Windows 10 reset - Choose Options

You will see Getting things ready page. The machine will be rebooted once reset completed and it will take you to Windows setup OOBE page.

Windows 10 reset

Out of Box Experience (OOBE)

We have reset our test VM in previous steps. Once reset process is completed, it will go to OOBE screen. The first few screens will have following details. The end user will go thorugh same experience.

Network connection : When you reset a Windows 10 OS, the network details such as WIFI connection and password are saved and automatically restore. Hence, you may not see this screen.

Region settings : Select the region

Keyboard layout : Select the Keyboard layout

Additional keyboard layout: This screen will allow you to add additional keyboard layout

license agreement : Acknowledge license agreement

OOBE - Region

The next screen will be for user login. If you don’t see your company branding and tenant details here then your device has not been identified as Windows Autopilot device.

The user should log in with their corporate ID and password. Enter your company corporate ID and click on Next.

Windows Autopilot - Login page

On the next screen, you will be prompted for the password. Enter the password and click on Next.

Windows Autopilot - Login page

The Enrollment Status Page (ESP) will be displayed on next screen.

Windows Autopilot - Enrollment Status Page (ESP)

The followings stages will be part of Enrollment Status page.

Device Preparation:

The following actions are included in Device preparation stage.

  • Securing your hardware
  • Joining your organization’s network
  • Registering your Device for Mobile Device Management
  • Preparing your device for mobile management

Device Setup:

The Device setup stage includes following steps.

  • Security Policies
  • Certificate
  • Network Connections
  • Apps

Account Setup:

The Account setup is the last stage of Enrollment Status Page. The following actions are associated with this stage.

  • Joining your organization’s network
  • Security policies
  • Certificates
  • Network connections
  • Apps

The next screen will be Privacy settings Toggle the settings on or off as per you requirements and click on Accept.

Windows Autopilot - Privacy Settings

Once configuration finished, user will get a prompt for additional authentication if Multi Factor Authentication (MFA) is enabled.

Multifactor Authentication Page

Your device will be ready to use now.

Related Posts:

Leave a Comment

Your email address will not be published. Required fields are marked *

Scroll to Top