Autopilot

Windows Autopilot is Microsoft's zero-touch provisioning service for new Windows devices. The hardware hash of a device is registered against a tenant (usually by the OEM at procurement), and on first power-on the device enrols itself in Microsoft Intune, joins Microsoft Entra ID, and pulls down corporate configuration, apps, and security baselines — without IT touching the device. Supports user-driven, self-deploying, pre-provisioning (white glove), and existing-device deployment scenarios. Replaces traditional imaging via Configuration Manager or MDT, and is the modern default for Windows endpoint provisioning in Microsoft 365 estates.

The four deployment modes

User-driven is the common case: a new laptop ships straight from the OEM or reseller to the employee's home or desk; they connect to Wi-Fi, sign in with their work account, and the rest — Entra join, Intune enrolment, apps, policies — happens automatically over roughly 20–60 minutes depending on app payload. Self-deploying skips the user sign-in entirely, useful for kiosks and shared devices that need to end up domain-joined and configured with no human present. Pre-provisioning (white glove) lets IT or a reseller run the time-consuming app-and-policy download in a staging environment before the device reaches the end user, so the user's own experience is a much shorter final step. Existing devices lets an already-imaged, domain-joined machine be re-registered into Autopilot for a future refresh without reimaging it now.

Worked example

A company buys 200 laptops directly from a distributor with Autopilot registration included in the order (most major OEMs support pushing the hardware hash straight to the tenant at the point of sale). IT never touches the boxes — they ship straight to the new hires' addresses. Each employee's first day: unbox, connect to home Wi-Fi, sign in with their Microsoft 365 account, and watch the Enrollment Status Page track through profile configuration, app installation, and policy application before landing on a fully configured desktop with security baselines, Conditional Access-compliant device status, and required line-of-business apps already installed. No image was built, no USB drive was shipped, and no support ticket was needed to get a working laptop into a remote employee's hands.

Deployment profile and the Enrollment Status Page

A deployment profile assigned to the device (via Entra ID dynamic group membership, typically) controls what the user sees during setup — whether they can skip the privacy/EULA screens, what the out-of-box-experience (OOBE) looks like, and whether the device is Entra-joined or Entra hybrid-joined. The Enrollment Status Page (ESP) is the screen that blocks the user from reaching the desktop until a defined set of apps and policies have finished applying — configurable per profile, so a tenant can decide whether a user is allowed in before every app finishes installing or must wait for a "day one critical" app list.

Common pitfalls

The most frequent failure mode is a device whose hardware hash was never registered — usually because procurement bypassed the OEM-direct registration path and bought through a channel that doesn't forward hashes automatically, requiring a manual PowerShell hash-capture step after the fact. The second is an ESP blocking list that's too long: if every app in the tenant is marked as a blocking, must-finish-before-desktop app, users sit at a progress screen for far longer than necessary, and support calls spike. Autopilot also depends on network connectivity working correctly at first boot — a device shipped to a home address with restrictive guest Wi-Fi or a captive portal can stall during enrolment in ways that are hard to diagnose remotely.