Ship a new laptop straight from the supplier to the employee, who unpacks it, turns it on, signs in with their work account, and fifteen minutes later has a fully configured PC. Without IT ever touching it. That's Windows Autopilot. This article explains how Autopilot works, what you need, which modes exist and how to set it up in four steps in Microsoft Intune.
What does Autopilot do?
- Deploy new devices without IT having to install or image them first.
- Automatically join devices to Microsoft Entra ID (or hybrid to Active Directory) and enroll them in Intune.
- Install apps, settings, security and Wi-Fi profiles automatically through Intune.
- Repurpose devices for a new employee with Autopilot Reset or a remote full reset.
What do you need?
- Licenses: Microsoft Intune and Microsoft Entra ID P1, for example through Microsoft 365 Business Premium or Microsoft 365 E3/E5.
- Windows 11 Pro, Enterprise or Education (Windows 10 has been out of support since October 2025).
- An internet connection during setup.
- Automatic enrollment in Intune turned on for your users.
Which mode should you choose?
| Mode | When |
|---|---|
| User-driven | The default: the employee signs in and the device becomes theirs |
| Self-deploying | Kiosks, meeting rooms, shared devices without a fixed user |
| Pre-provisioned | IT or the supplier installs apps in advance, so the user is ready faster |
| Autopilot device preparation | Newer, simpler variant without registering a hardware hash first; fewer options |
Set up Autopilot in four steps
- Register devices. Have your supplier or partner register devices at purchase, or upload the hardware hash of existing devices in Intune under Devices > Windows > Enrollment > Devices. From an existing PC, collect it with PowerShell:
Install-Script Get-WindowsAutopilotInfo Get-WindowsAutopilotInfo -Online
- Create a group. Create a dynamic group in Entra ID with all Autopilot devices, for example with the rule (device.devicePhysicalIDs -any (_ -startsWith "[ZTDId]")).
- Create a deployment profile. In Intune: Devices > Windows > Enrollment > Deployment profiles. Choose the mode, Entra join, language and what the user sees, and assign the profile to the group.
- Configure the Enrollment Status Page. Under Enrollment Status Page, decide which apps and settings must be installed before the user sees their desktop.
The user then turns on the device, picks a language and Wi-Fi, and sees a sign-in screen with your organization's name.
Tips
- Test with one device and a small pilot group first.
- Keep the number of required apps on the Enrollment Status Page small; every extra app adds waiting time.
- Use BitLocker and Windows Hello for Business through Intune, so every device is encrypted and passwordless from day one. See also passwordless sign-in in Microsoft 365.
Nederlandstalige versie: Windows Autopilot: wat het is en hoe je het opzet in 4 stappen
Related articles
▸Build a Windows Autopilot demo environment in about an hourBuild your own Windows Autopilot demo with a test tenant, a Hyper-V VM and Intune, and watch a PC set itself…
▸Install Windows 11 and bring the PC into Intune right awayInstall Windows 11, sign in with your work account and let the PC enroll automatically in Microsoft Intune…
▸Install the Intune Company Portal automatically on all computersInstall the Intune Company Portal automatically on every Windows PC, make apps available for self-service and…
▸Stop traditional management and start modern management with IntuneHow to move from domain, GPOs and images to modern management with Intune, Autopilot, Entra ID and Defender…
▸Turn on BitLocker in Windows 11 and keep your recovery key safeEncrypt your drive with BitLocker in Windows 11. Device encryption in Home, storing and finding the recovery…