Windows Autopilot Enrollment on Windows 11 — End-to-End Lab Guide

Windows Autopilot is Microsoft's cloud-based device provisioning solution that eliminates the need for traditional imaging or manual IT setup. When a user turns on a new device for the first time, Autopilot automatically joins Azure AD (Entra ID), enrols into Microsoft Intune, pulls down all assigned policies and compliance rules, installs required apps, and names the device according to your naming template — all without any IT hands-on intervention.

The hardware hash (HWID) is a unique cryptographic fingerprint that identifies the device to Microsoft's Autopilot service. Open PowerShell as Administrator and run the commands below. When prompted, confirm installing NuGet and accept from PSGallery. The script saves the hardware details to C:\HWID\AutopilotHWID.csv. Verify with dir.

With the hardware hash CSV ready, upload it to the Microsoft Intune admin center to register the device in the Windows Autopilot service.

📱 intune.microsoft.com → Devices → Enrollment → Windows → Windows Autopilot Devices → Import

Click Import, browse to C:\HWID\AutopilotHWID.csv, and confirm the formatting results show "1 row formatted correctly" before clicking Import.

After the import completes (allow a few minutes), click Sync then Refresh. The device will appear showing the serial number, manufacturer, and a profile status of "Not assigned" — expected until a deployment profile is attached in Step 4.

Autopilot profiles and Intune policies are assigned to groups, not individual devices. A Dynamic Device Group automatically includes any device registered in Autopilot using the ZTDId attribute — no manual device additions needed.

🌐 entra.microsoft.com → Groups → New Group → Security → Dynamic Device

Set the Group name (e.g. Win-Autopilot) and configure the membership rule below. Use the Validate Rules tab to confirm your device resolves as "In group" before saving.

The deployment profile controls how the OOBE behaves — the deployment mode, join type, which screens to skip, and the device naming convention.

📱 intune.microsoft.com → Devices → Enrollment → Windows → Deployment Profiles → Create Profile → Windows PC

Name the profile (e.g. Win11_Autopilot) and set Convert all targeted devices to Autopilot to Yes.

This is the most critical tab. Configure it for a secure, streamlined user-driven deployment:

→ Deployment mode: User-Driven
→ Join to Microsoft Entra ID as: Microsoft Entra joined
→ Microsoft Software License Terms: Hide
→ Privacy settings: Hide
→ Hide change account options: Hide
→ User account type: Standard (not Administrator)
→ Apply device name template: Yes — using CORP-%SERIAL%

The CORP-%SERIAL% template auto-generates a unique, traceable device name using the hardware serial number.

Assign the profile to the Win-Autopilot dynamic group from Step 3. Every Autopilot-registered device will automatically receive this deployment profile.

On the Review + Create tab, verify the profile name, all OOBE settings, and the assigned group, then click Create. The profile will appear in the list with Join type "Microsoft Entra joined" and Assigned: Yes.

The ESP is shown during OOBE and blocks the user from reaching the desktop until configuration is complete — preventing support calls from users on half-configured devices.

📱 intune.microsoft.com → Devices → Enrollment → Windows → Enrollment Status Page

Edit the default ESP profile with these settings:

→ Show app and profile configuration progress: Yes
→ Show error when installation takes longer than: 60 minutes
→ Show custom message on timeout/error: Yes — "Setup could not be completed. Please try again or contact your support person for help."
→ Turn on log collection and diagnostics for end users: Yes
→ Only show page to OOBE provisioned devices: Yes
→ Install Windows updates: Yes
→ Block device use until all apps and profiles are installed: Yes
→ Block device use until required apps are installed: All

After the reset, the device boots into the Autopilot-customised OOBE. On the "Let's set things up for your work or school" welcome screen, the user enters their Microsoft 365 / Entra ID credentials. The privacy and license terms screens are skipped automatically per the deployment profile.

If this is the user's first sign-in or their password has expired, Windows will prompt them to update it before continuing. This is standard Entra ID / Active Directory password policy enforcement and is expected behaviour on first Autopilot enrolment.

After authentication, the Enrollment Status Page displays three-phase configuration progress. The user cannot access the desktop until all three complete successfully:

→ Device Preparation — Intune enrols the device and downloads the management profile
→ Device Setup — Device configuration profiles and required system apps are applied
→ Account Setup — User-targeted apps and policies are installed for the signed-in account

Total time depends on the number of apps and policies assigned. With the 60-minute timeout set in Step 5, the user sees a clear error message if something stalls rather than an unexplained frozen screen.

During the Account Setup phase, users with MFA enforced via Conditional Access are prompted to register the Microsoft Authenticator app by scanning a QR code. The user scans the code on their phone, then clicks Next to continue. Once MFA is registered, Account Setup completes and the user reaches the desktop.

Once OOBE completes, verify the enrollment in Windows 11 Settings:

⚙️ Settings → Accounts → Access work or school

The device should show as Connected to [your tenant] Entra ID and Managed by [your organisation] via Intune. The Export your management log files option confirms full MDM management is active.

You can also verify from the Intune portal: intune.microsoft.com → Devices → All devices — the device should appear with Join type Microsoft Entra joined, Managed by Intune, and compliance status reflecting your assigned compliance policies.

Step 1 — Extract HWID: Hardware hash CSV generated from the Windows 11 device via PowerShell
Step 2 — Import to Intune: Device registered in Windows Autopilot, profile status "Not assigned"
Step 3 — Dynamic Group: Win-Autopilot group with ZTDId membership rule — device auto-joined on import
Step 4 — Deployment Profile: Win11_Autopilot configured User-Driven, Entra joined, CORP-%SERIAL% naming, assigned to dynamic group
Step 5 — ESP: Desktop blocked until all apps and policies installed, 60-minute timeout with custom error message
Step 6 — OOBE: User signed in, password updated, MFA registered via Authenticator, all three ESP phases completed
Step 7 — Verified: Device connected to Entra ID, managed by Intune, MDM logs confirmed ✔