What is Windows Autopilot, and how do you set it up in Intune?

Last updated August 12, 2026

What Windows Autopilot actually does

Traditionally, provisioning a new Windows laptop meant wiping it, applying a custom image, joining it to the domain, and installing software by hand — an hour or more per device, done by someone technical. Autopilot replaces that with a cloud-driven process:

• The device is registered with your tenant using a unique hardware ID.
• When the user first turns it on and connects to the internet, Windows recognizes it belongs to your organization.
• The user signs in once with their Microsoft 365 account. Entra ID joins the device, Intune enrolls it, and your compliance policies, Conditional Access, apps, and settings apply automatically.
• The laptop can ship directly from the vendor to the employee — IT never has to physically touch it.

The result is zero-touch provisioning: no imaging, no manual domain join, no golden image to maintain. The experience is the same for a remote employee across the country as for someone down the hall.

What you need before you start

• Intune and Entra ID — both are included in Microsoft 365 Business Premium, E3, and E5. If you're not sure whether your plan includes Intune, see do I need Business Premium for Intune?
• Windows 10 or 11 Pro, Enterprise, or Education — Autopilot doesn't run on Windows Home.
• A way to register devices — either the hardware hash exported from each device, or, more cleanly, an OEM or reseller (CSP) that registers devices to your tenant at the point of purchase.
• An Entra ID group to assign the Autopilot profile to. A dynamic group keyed on Autopilot attributes is the usual approach; dynamic groups require Entra ID P1, which Business Premium, E3, and E5 all include.

How to set up Windows Autopilot in Intune, step by step

This is the shape of a working Autopilot configuration, whether you do it yourself or have it done:

1. Confirm licensing and prerequisites. Verify Intune and Entra ID are active (both are included with Business Premium, E3, and E5) and that your devices run Windows 10 or 11 Pro, Enterprise, or Education.
2. Register your devices. Import each device's hardware hash into Intune under Windows enrollment, or have your OEM or reseller register the devices to your tenant so they appear automatically.
3. Create a deployment profile. Create a Windows Autopilot deployment profile in Intune that defines the out-of-box experience: the deployment mode, which setup screens to skip, and the device naming convention.
4. Assign the profile to a group. Assign the profile to an Entra ID device group. A dynamic group that automatically captures Autopilot-registered devices means new hardware is covered without manual steps.
5. Configure the Enrollment Status Page (ESP). Set up the ESP so the device shows setup progress and blocks the user from the desktop until required apps and policies have applied.
6. Test on one device. Reset a pilot device and walk through the out-of-box experience exactly as an employee would. Confirm it enrolls, applies policy, and installs the right apps before going wider.
7. Roll out to the fleet. Once the pilot is clean, register the rest of your devices, or route future purchases through OEM or reseller registration so every new laptop is Autopilot-ready on arrival.

Autopilot deployment modes

• User-driven — the most common. The employee signs in with their own account and the device is set up for them. Right for standard laptops.
• Self-deploying — no user credentials during setup; the device provisions itself. Used for kiosks, digital signage, and shared devices.
• Pre-provisioned (formerly White Glove) — IT or the reseller runs the heavy part of provisioning before the device reaches the user, so the employee's first-run experience is just a quick sign-in. Useful when apps are large or setup time matters.

Microsoft has also introduced Windows Autopilot device preparation, a newer Entra-native flow that simplifies some of the setup above. The classic profile-based process described here is still widely used and supported; which one fits depends on your environment.

Common Autopilot problems

• Devices not showing up. Usually a hardware-hash import issue, or the device was registered to the wrong tenant.
• Enrollment Status Page timeouts. The ESP blocks too long because a required app is large or misconfigured — tune which apps are marked "blocking."
• Hybrid join complications. Autopilot is simplest with cloud-native Entra join. Hybrid (on-prem Active Directory) join adds network line-of-sight and timing requirements that cause most failures.
• Wrong deployment mode. A shared device set to user-driven — or a standard laptop set to self-deploying — leads to confusing first-run behavior.

Most Autopilot problems trace back to prerequisites and profile design, not the technology itself — which is exactly why testing on one device before rollout matters.

Where Autopilot fits in a full Intune deployment

Autopilot is one piece of a complete Intune setup. It handles how Windows devices arrive and enroll, but the policies it applies — compliance, Conditional Access, app management — have to be designed first. Getting that order right, policy design before enrollment, is the single most common thing that separates a smooth deployment from one that has to be redone.

For what a full deployment costs and what drives the number, see how much it costs to set up Intune for a small business. For the work broken down by tier, see what's included at each service tier. And if you're not yet sure your licensing even includes Intune and Entra ID, start with do I need Business Premium for Intune?