What is Windows Autopilot?
Windows Autopilot is Microsoft's zero-touch provisioning framework that transforms a factory-fresh Windows device into a corporate-managed workstation without any IT imaging. The device ships directly to the end user, who signs in with their corporate credentials — Autopilot handles Azure AD Join, Intune enrollment, and app deployment automatically.
From a deployment architecture perspective, Autopilot sits at the intersection of Azure Active Directory, Intune (Microsoft Endpoint Manager), and the Windows Out-of-Box Experience (OOBE). The provisioning flow is entirely cloud-driven: no local MDT/SCCM server, no golden image, no USB drive.
Prerequisites & Licences
Before you start, confirm the following are in place:
- Azure AD Premium P1 (included in M365 E3/F3) — required for MDM auto-enrollment and conditional access integration.
- Microsoft Intune licence assigned to each user (included in M365 E3/F3/BP).
- Windows 10 Pro/Enterprise 1903+ or Windows 11 on the target devices.
- Azure AD tenant with a verified domain and Global Admin / Intune Administrator rights.
- For Hybrid AADJ: a domain-joined server running the Intune Connector for Active Directory, plus line-of-sight to a Domain Controller during provisioning.
| Deployment Mode | Join Type | User Type | Best For |
|---|---|---|---|
| User-driven | Azure AD Join | Cloud-only | Remote workers, new hires |
| User-driven | Hybrid Azure AD Join | AD + AAD synced | Traditional orgs migrating to cloud |
| Self-deploying | Azure AD Join | Shared / kiosk | Meeting rooms, shared workstations |
| Pre-provisioning (White Glove) | Azure AD / Hybrid | Either | High-touch pre-staging by IT |
Collecting & Uploading Hardware Hashes
Every Autopilot device must be registered with your tenant via its hardware hash — a cryptographic fingerprint derived from the device's hardware IDs. There are three ways to collect hashes:
Option A — PowerShell on a fresh device (OOBE stage)
Boot the device to the OOBE screen, press Shift+F10 to open a command prompt, then run:
Install-Script -Name Get-WindowsAutopilotInfo -Force Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force Get-WindowsAutopilotInfo -Online
The -Online flag registers the device directly to your tenant after you authenticate. For bulk collection, omit -Online and use -OutputFile hashes.csv to generate a CSV for later import.
Option B — OEM/Reseller registration
Microsoft-authorised resellers (Dell, Lenovo, HP, etc.) can register devices to your tenant at time of purchase using the Microsoft Partner Center. This is the recommended path for large orders — no manual hash collection required.
Option C — CSV import in MEM Admin Center
Device Serial Number, Windows Product ID, Hardware Hash.Creating the Deployment Profile
The Autopilot deployment profile controls the OOBE experience and the join type. Go to Devices → Windows → Enrollment → Deployment Profiles → Create Profile → Windows PC.
Key profile settings
| Setting | Recommended Value | Notes |
|---|---|---|
| Deployment mode | User-driven | Use Self-deploying for kiosks |
| Join to Azure AD as | Azure AD joined | Or Hybrid — see next section |
| Microsoft Software Licence Terms | Hide | Pre-accepted by IT |
| Privacy settings | Hide | Reduces OOBE steps for users |
| Account change options | Hide | Prevents users changing the join type |
| User account type | Standard | Admin only if explicitly needed |
| Apply device name template | e.g. WKS-%RAND:4% | Unique names help with asset management |
Configuring the Enrollment Status Page
The ESP (Enrollment Status Page) is the progress screen shown during provisioning. It blocks device use until all assigned apps and policies are installed, ensuring the device is fully compliant before the user reaches the desktop.
Navigate to Devices → Windows → Enrollment → Enrollment Status Page → Create.
Recommended ESP settings
- Show app and profile configuration progress: Yes
- Show error when installation takes longer than X minutes: 60 (adjust based on your app set)
- Allow users to collect logs: Yes (critical for support)
- Only show page to devices provisioned by OOBE: Yes
- Block device use until all apps and profiles are installed: Yes (for security-sensitive environments)
Hybrid Azure AD Join Variant
If your environment uses on-premises Active Directory synced to Azure AD via Azure AD Connect, you will need the Hybrid AADJ variant. This joins the device to both your on-prem domain and Azure AD simultaneously.
Additional requirements for Hybrid AADJ
- The Intune Connector for Active Directory must be installed on a domain-joined Windows Server with line-of-sight to your DCs.
- The provisioning device must have network access to a DC during OOBE (VPN or on-site).
- Azure AD Connect must have the device writeback feature enabled.
- The computer account OU must be in scope for Azure AD Connect sync.
# Run on the connector server to verify service health Get-Service -Name "ODJConnectorService" | Select Name, Status, StartType # Check the connector log for errors Get-Content "C:\ProgramData\Microsoft\ODJConnector\Logs\ODJConnector.log" -Tail 50
Testing the End-to-End Flow
Before rolling out to production users, validate the complete flow on a test device:
dsregcmd /status to confirm join state, and open Settings → Accounts → Access work or school to verify Intune enrollment.Common Error Codes & Fixes
The table below covers the most frequent Autopilot errors encountered in production. For detailed fix steps on specific codes, see the Troubleshooting Hub.
| Error Code | Meaning | Quick Fix |
|---|---|---|
0x801c03ea | Azure AD Join blocked | Check AAD device settings and MDM scope |
0x80180014 | MDM enrollment not authorised | Verify user has Intune licence |
0x801c0003 | User not allowed to join Azure AD | Check "Users may join devices" in AAD settings |
0x80070774 | No Autopilot profile found | Confirm device is registered and group is assigned |
| ESP timeout | App install exceeded time limit | Check IME logs; reduce blocking app list |