imPC@ndo IT

Guides / intune

Configure Windows Autopilot with Microsoft Intune

From an empty tenant to a device that provisions itself out of the box: deployment profile, dynamic group, Enrollment Status Page and company branding.

Traditionally, preparing a PC for a new employee took hours of manual work: OS installation, corporate settings, app deployment. Windows Autopilot eliminates all of that. The moment a user opens a brand-new device and connects to the internet, Intune takes over — applying policies, installing apps, and joining Entra ID automatically. The IT team never has to touch the hardware. This guide walks through the complete setup, from dynamic group creation to the first OOBE test.

What is Windows Autopilot?

Windows Autopilot is a cloud-based provisioning technology built into Windows and managed through Microsoft Intune. Instead of imaging devices or running manual setup scripts, IT configures policies once in the cloud — and every new device self-configures when the user powers it on for the first time.

  • Zero-touch deployment: devices can ship directly from the vendor to the end user — no IT handling required
  • Consistent configuration: every device receives the same policies, apps, and settings automatically
  • Reduced IT overhead: no more OS images to maintain or manual setup procedures
  • Native Intune + Entra ID integration: centralized lifecycle management from day one

Prerequisites & Licensing

Windows Autopilot requires a license that includes Microsoft Intune and Entra ID P1 or higher. The most cost-effective option for SMBs is Microsoft 365 Business Premium, which bundles everything you need:

  • Microsoft Intune — policy and device management
  • Entra ID P1 — dynamic groups, Conditional Access
  • Defender for Business — endpoint security
  • Microsoft 365 Apps — Office suite included

Create a Dynamic Group in Entra ID

A dynamic device group automatically collects all Windows devices that match a defined rule. Devices are added or removed automatically as they enroll — no manual group management needed.

  1. Sign in to portal.azure.com with a Global Administrator account.
  2. Search for and open Microsoft Entra ID.
  3. In the left menu under Manage, click Groups.
  4. Click New group — set type to Security.
  5. Give it a descriptive name such as Autopilot-Windows-Devices.
  6. Set Membership type to Dynamic Device.
  7. Click Add dynamic query and configure: deviceOSType → Equals → Windows.
  8. Click Validate Rules to confirm which devices would match, then Save.

Configure Company Branding

During the Out-of-Box Experience (OOBE), the user will see the Microsoft sign-in screen. Adding company branding creates a professional first impression and reduces user confusion.

  1. In Entra ID, open Company branding and click Customize.
  2. Upload your company logo, a background image, and set brand colors.
  3. In the Sign-in page text field, add a personalized welcome message (e.g., “Welcome to [Company] — please sign in with your work account”).
  4. Click Save.

Get and Import the Hardware Hash

Each Windows device has a unique hardware hash — a cryptographic fingerprint that identifies it to the Autopilot service. This hash must be imported into Intune before the device can receive its Autopilot profile.

Method 1 — PowerShell with Direct Online Import (Recommended)

This method collects and uploads the hardware hash directly to your Intune tenant in a single operation — no CSV file handling needed.

Open PowerShell as Administrator on the device to be registered and run these commands in order:

PowerShell.exe -ExecutionPolicy Bypass
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-Script -Name Get-WindowsAutopilotInfo -Force
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Get-WindowsAutopilotInfo -Online

What each line does:

  1. -ExecutionPolicy Bypass — temporarily disables script execution restrictions for this session
  2. SecurityProtocol TLS 1.2 — forces the secure connection required to download from PowerShell Gallery
  3. Install-Script Get-WindowsAutopilotInfo — downloads the official Microsoft script from PowerShell Gallery
  4. Set-ExecutionPolicy RemoteSigned — sets the execution policy for the current process
  5. Get-WindowsAutopilotInfo -Online — collects the hardware hash and uploads it directly to Intune, prompting for authentication

Method 2 — MDM Diagnostic Logs (Alternative)

Navigate to Settings → Accounts → Access work or school, click Export your management log files, then find the hash in C:UsersPublicDocumentsMDMDiagnosticsMDMDiagReport. Use this method when the device has no internet access during registration.

Import the Hash in Intune (Manual CSV)

  1. Go to Devices → Windows Enrollment → Autopilot Devices in Intune.
  2. Click Import and upload the CSV file.
  3. Refresh after a few minutes — the device will appear in the list with its serial number.

Create an Autopilot Deployment Profile

The deployment profile defines the OOBE experience: how the device joins Entra ID, what screens are shown to the user, and what account type is created. You can create multiple profiles for different departments.

  1. In Intune, go to Devices → Windows Enrollment → Deployment Profiles.
  2. Click + Create profile → Windows PC.
  3. Give the profile a name (e.g., Autopilot – Sales Department).
  4. Configure the OOBE settings as recommended below.
  5. In Assignments, add the dynamic group created in Step 1.
  6. Click Create. Refresh the Autopilot Devices page — you’ll see the profile assigned.

Recommended OOBE configuration settings:

SettingRecommended Value
Deployment modeUser-driven
Join to Entra ID asEntra ID joined
Microsoft Software License TermsHide
Privacy settingsHide
User account typeStandard
Auto-configure keyboardYes
Apply device name templateYes (e.g., AZ-%RAND:4%)

Assign Apps via Intune

App deployment happens through Intune policies assigned to the same Autopilot group. Apps marked as Required install silently during or after OOBE — no user action needed.

Microsoft 365 Apps (Office)

  1. In Intune, go to Apps → Windows Apps → + Add.
  2. Select Microsoft 365 Apps – Windows 10 and later.
  3. Configure the suite (Word, Excel, Outlook, Teams, etc.).
  4. Set assignment to Required for the Autopilot group and click Create.

Google Chrome Enterprise

  1. Download the standalone enterprise MSI from the Chrome Enterprise download page.
  2. In Intune, add a Line-of-business app and upload the MSI.
  3. Assign as Required to the Autopilot group.

Configure OneDrive Auto-Sync

With a Settings Catalog policy, OneDrive can be silently signed in and configured to back up known folders before the user even opens it. This is one of the highest-value policies to deploy alongside Autopilot.

  1. Go to Devices → Configuration → Policies → Create policy.
  2. Platform: Windows 10 and later — Profile type: Settings catalog.
  3. Search for OneDrive and enable these settings:
  4. Silently sign in users to the OneDrive sync app with their Windows credentials — enables silent SSO so users are auto-authenticated.
  5. Silently move Windows known folders to OneDrive — backs up Desktop, Documents, and Pictures automatically.
  6. Use OneDrive Files On-Demand — files appear in Explorer but only download when opened, saving disk space.
  7. Silently sign in users to the OneDrive sync app with their Windows credentials — enter your Tenant ID (found in Entra ID → Overview).
  8. Assign to All users and All devices, then click Create.

Test the Autopilot Flow

Always test on a VM or a spare physical device before rolling out to production. This validates your entire configuration end-to-end.

  1. On a test Windows 11 device or VM, go to Settings → System → Recovery and reset the PC (choose Remove everything).
  2. On restart, the OOBE screen should display your company branding.
  3. Sign in with a test user’s Microsoft 365 credentials.
  4. Windows will self-configure: Entra ID join, policy application, and app installation happen automatically.
  5. Verify that all assigned apps installed correctly.
  6. Confirm OneDrive is already signed in and syncing.
  7. In Intune, check the device under Devices → All devices — it should show as Compliant.

Wrapping Up

Windows Autopilot fundamentally changes how organizations provision endpoints. A one-time setup of a few hours eliminates manual device preparation entirely and ensures every new employee gets a fully configured, corporate-ready device on day one — wherever they are in the world.

  • Create a dynamic Entra ID group to auto-collect Windows devices
  • Import the hardware hash via PowerShell -Online flag
  • Create a deployment profile with recommended OOBE settings
  • Assign apps and OneDrive auto-sync to the Autopilot group
  • Test end-to-end on a VM before production rollout
  • Result: zero-touch provisioning — device ships directly to the user

Autopilot + Intune + Entra ID is the modern standard for Windows device management in Microsoft 365 environments. Once operational, it scales effortlessly whether you’re onboarding one employee or one thousand.