⚠️
Prerequisites: Windows 10 v1703+, Azure AD Premium licence, Intune licence, devices connected to internet during OOBE, OEM that supports Autopilot.
Step 1
Extract Hardware Hash & Import Devices
Run the Get-WindowsAutopilotInfo script on each device to extract the hardware hash, then import the resulting CSV into Intune.
Install-Script -Name Get-WindowsAutopilotInfo Get-WindowsAutopilotInfo -OutputFile C:\HWID\DeviceID.csv
Then in Intune: endpoint.microsoft.com → Devices → Windows → Windows Enrollment → Autopilot → Devices → Import CSV
Step 2
Create a Deployment Profile
Navigate to Windows Enrollment → Deployment Profiles → Create Profile and set:
→
Platform
Windows PC
→
Deployment Mode
User-Driven
→
Convert all targeted devices to Autopilot
Yes
Step 3
Create Dynamic Azure AD Group
In Azure AD → Groups → New Group → Dynamic Device. Use this membership rule to automatically include all Autopilot devices:
(device.devicePhysicalIDs -any _ -contains "[ZTDId]")
Step 4
Assign Apps & Policies
Target the Autopilot group with everything the device needs out of OOBE:
→
Apps
Intune → Apps → assign required apps to the Autopilot group
→
Wi-Fi Profile
Device configuration → Wi-Fi profile assigned to the group
→
Compliance & Restrictions
Assign compliance policies and device restriction profiles