Deploy Home windows 11 with Autopilot and Get rid of Imaging

Earlier than you construct yet one more golden picture to your subsequent Home windows 11 rollout, depend what that picture really prices you. Each {hardware} refresh means recapturing drivers and resequencing functions, then babysitting a activity sequence that breaks the second a brand new laptop computer mannequin reveals up. Home windows Autopilot exists to retire that workflow: the gadget boots into the usual out-of-box expertise (OOBE), and the cloud turns the manufacturing facility Home windows set up right into a business-ready, policy-managed machine with no imaging step in any respect. If you happen to’re able to deploy Home windows 11 with Autopilot, this information is the complete path from tenant stipulations to a verified pilot gadget.

By the tip, you’ll have deployed one pilot machine finish to finish, so you’ll acknowledge the failures you meet alongside the way in which by their error codes earlier than they’ll stall a stay rollout.

What Is Home windows Autopilot?

Recognizing these error codes begins with figuring out what the service really does to a tool between power-on and desktop. Home windows Autopilot is, in Microsoft Be taught’s personal phrases, “a set of applied sciences used to arrange and pre-configure new units, getting them prepared for productive use.” The gadget ships from the OEM with Home windows already put in, and the Home windows Autopilot service transforms that set up into an organization-ready state with no reimaging step: becoming a member of the machine to Microsoft Entra ID, enrolling it in Microsoft Intune, making use of insurance policies, putting in apps, and even altering the version from Home windows Professional to Enterprise, all throughout the first power-on.

Forrester’s Whole Financial Impression examine, commissioned by Microsoft, put numbers on the shift: a composite group shifting to Microsoft 365 E3, Intune, and Autopilot noticed a 197% return on funding over three years and roughly 25,000 hours of endpoint deployment time saved. These figures come from a vendor-commissioned mannequin of a composite group, so weigh them accordingly; the mechanism behind them is actual: picture upkeep disappears out of your funds.

Why Home windows 11 Makes This the Second to Transfer

Home windows 10 reached its finish of assist date in October 2025, so machines nonetheless working it now get no free safety updates, and Autopilot is the migration mechanism that will get them onto Home windows 11. You register every gadget as soon as, and one profile then covers each recent units and reprovisioned ones. If you happen to nonetheless have Home windows 10 machines to maneuver, you’re planning an Autopilot challenge whether or not you name it that or not.

Conditions

Autopilot ships as a functionality inside subscriptions you doubtless already maintain, with no separate product to license. To comply with alongside hands-on, you want the next:

• A Microsoft Entra ID tenant with Microsoft Intune licensing for enrolling customers; Microsoft 365 E3/E5, Enterprise Premium, and F1/F3 all qualify. With out an Intune license on the signing-in person, enrollment hangs on the Enrollment Standing Web page (ESP), the progress display that runs throughout provisioning.

• Microsoft Entra ID P1 or P2 plus computerized MDM enrollment enabled, so units that be part of Entra ID throughout OOBE additionally enroll in Intune.

• A International Administrator or Intune Administrator account for the portal work, plus a check person with an Intune license for the pilot sign-in.

• Home windows 11 Professional, Enterprise, or Training on the right track units. House editions don’t assist Autopilot, and self-deploying mode requires a TPM 2.0 module.

• Web entry from the gadget. A cloud-only be part of wants no VPN and no domain-controller line of sight; the hybrid path adjustments that.

Portal paths comply with the present Microsoft Intune admin middle format, and PowerShell instructions run in an administrator PowerShell session on Home windows 11; version-specific necessities are referred to as out the place they apply.

Deciding the Deployment Path: Cloud Be part of, Hybrid Be part of, or System Preparation

Settle the be part of sort earlier than you create something, as a result of it narrows which provisioning mechanism you should use. How the gadget joins decides your profile settings; which provisioning mechanism you utilize decides your group guidelines.

Cloud-Solely Microsoft Entra Be part of

The gadget joins Entra ID throughout OOBE and enrolls in Intune with no dependency on on-premises Lively Listing. That is the trail Microsoft designs for, and the one each step of the user-driven Microsoft Entra be part of workflow assumes. Provisioning works over any web connection, so a laptop computer can ship straight to a house workplace and enroll itself. Select it until a concrete dependency forces hybrid.

Hybrid Microsoft Entra Be part of

Hybrid be part of retains the gadget a member of on-premises Lively Listing whereas registering it in Entra ID, which issues when legacy domain-joined workflows or GPO-bound functions nonetheless rule. The price is actual: you will need to set up the Intune Connector for Lively Listing on a server that may attain a website controller, and the gadget wants line of sight to that controller throughout provisioning, which distant customers fulfill with an always-on VPN. Microsoft’s ESP documentation notes hybrid deployments take 40 minutes longer than the timeout you configure, as a result of the connector should create the gadget document in Entra ID first. That tax plus the connector make hybrid the main supply of Autopilot failures, so deal with hybrid be part of as a brief state and plan the transfer to cloud-only be part of. The GPO-to-Intune migration challenge is the work that allows you to finally depart hybrid behind.

Actuality Test: If somebody proposes hybrid be part of “simply to maintain GPOs working,” push again. Hybrid Autopilot wants a domain-joined connector server, line of sight to a website controller throughout OOBE, and carries the very best failure fee of any Autopilot path. Transfer the GPOs that matter to Intune first, then deploy cloud-only.

Home windows Autopilot System Preparation

Home windows Autopilot gadget preparation is a second provisioning expertise for Home windows 11, and it removes the 2 friction factors of traditional Autopilot: {hardware} hash registration and dynamic group lag. Its core mechanism is Enrollment Time Grouping: the gadget joins a pre-defined safety group the second the person authenticates, so assigned apps, scripts, and insurance policies deploy instantly.

The tradeoffs matter. System preparation requires Home windows 11 22H2 or 23H2 with the KB5035942 replace, or 24H2 and later, per Microsoft’s gadget preparation necessities, and helps solely cloud-only be part of, so you possibly can’t use it when you want hybrid be part of. Traditional Autopilot stays the fitting alternative for hybrid be part of, Home windows 10 holdovers, or OEM-registered fleets. Consider gadget preparation first for a greenfield cloud-only rollout; this information walks traditional Autopilot as a result of it covers extra environments.

Registering Units With Home windows Autopilot

Earlier than a tool can use Autopilot, it should be registered with the Home windows Autopilot deployment service. Registration and enrollment are separate occasions: Microsoft’s registration overview confirms a registered gadget already seems in Intune’s Home windows Autopilot Units record. That gadget turns into an enrolled Intune gadget, seen in the primary Home windows units record, solely after Autopilot runs on it for the primary time. Registration tells the cloud which {hardware} belongs to your tenant so your profile is utilized throughout OOBE.

Registering By way of an OEM or Accomplice

The popular path for brand new {hardware} is to have the OEM, reseller, or CSP register units earlier than delivery. You hand over your tenant ID, they add the {hardware} identities, and containers arrive already acknowledged. Affirm they seem below Home windows Autopilot units in Intune after supply.

Warning: Autopilot registration marks a tool as corporate-owned. Don’t add hashes for personally owned machines or units already enrolled as Microsoft Entra registered (office joined); Microsoft explicitly lists each as units that shouldn’t be registered, and fixing it means deleting the gadget from Intune and Entra ID and beginning over.

Registering Current Units With PowerShell

For machines already in your possession, or for lab testing, harvest the hash your self. The documented PowerShell methodology runs in an administrator PowerShell session on the gadget:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Merchandise -Sort Listing -Path "C:HWID"
Set-Location -Path "C:HWID"
$env:Path += ";C:Program FilesWindowsPowerShellScripts"
Set-ExecutionPolicy -Scope Course of -ExecutionPolicy RemoteSigned
Set up-Script -Title Get-WindowsAutopilotInfo
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

The primary six strains set TLS 1.2 for the Gallery obtain, create and enter a working folder, put the Gallery script path on $env:Path, loosen up the execution coverage for this course of solely so the script can run with out altering machine coverage, and set up Get-WindowsAutopilotInfo. The final command writes a CSV with the serial quantity, Home windows product ID, and {hardware} hash. Hashes embrace timing particulars and alter with each technology, so acquire near rollout and regenerate after a motherboard substitute. You can too add immediately with the -On-line change, which skips the CSV.

Importing the CSV and Syncing

Check in to the Microsoft Intune admin middle, open Units > Home windows > Enrollment > Home windows Autopilot > Units, select Import, level the picker at your CSV, and make sure. Every add accepts as much as 500 units, per Microsoft’s documented CSV gadget restrict, and afterward you will need to choose Sync, which you’ll be able to run solely as soon as each 10 minutes, so batch uploads first. Refresh and watch to your machines with a Profile standing of Unassigned, which adjustments solely after a profile is assigned later on this information.

Creating the Autopilot System Group

The deployment profile, the Enrollment Standing Web page, and your app assignments all goal gadget teams. Microsoft’s gadget group tutorial recommends dynamic teams past a handful of check machines, since sustaining an assigned group by hand throughout lots of of units doesn’t scale.

Dynamic System Group for One Pilot System

Create the group with the Microsoft Graph PowerShell SDK so the membership rule lives in supply management and replays for each ring. Microsoft paperwork an actual -eq match on solely two gadget attributes for dynamic-membership guidelines: OrderID (group tag) and PurchaseOrderId. A tool’s ZTDId helps solely the broader -startsWith match, so scoping a rule to a single pilot machine means giving that machine its personal group tag. Open the pilot gadget’s entry below Home windows Autopilot units in Intune, edit its Group tag to a singular worth, for instance PilotDevice001, and choose Save.

Join-MgGraph -Scopes "Group.ReadWrite.All"

New-MgGroup -DisplayName 'Autopilot Pilot Units' `
    -MailEnabled:$false `
    -MailNickname 'autopilotpilot' `
    -SecurityEnabled `
    -GroupTypes 'DynamicMembership' `
    -MembershipRule '(gadget.devicePhysicalIds -any (_ -eq "[OrderID]:PilotDevice001"))' `
    -MembershipRuleProcessingState 'On'

-GroupTypes 'DynamicMembership' is what makes the rule consider in any respect; with out it the group stays static and -MembershipRule is ignored. -MembershipRuleProcessingState 'On' begins analysis instantly reasonably than leaving the rule paused, and Group.ReadWrite.All is the delegated permission the create name wants. As a result of solely the pilot gadget carries the PilotDevice001 tag, this rule matches precisely that one machine; the following part applies the identical tagging mechanism at fleet scale.

Group Tags for Fleet Scale

For manufacturing, use group tags. A tag is a label assigned at registration, both by your OEM or with -GroupTag "AutopilotPilot" on the PowerShell script, and it seems within the gadget’s bodily IDs with the prefix [OrderID]:. One dynamic rule then catches each tagged gadget:

(gadget.devicePhysicalIds -any (_ -eq "[OrderID]:AutopilotPilot"))

That sample phases rollouts: register the primary wave with an AutopilotPilot tag and level a pilot group at it, then later waves with AutopilotRing1 and AutopilotRing2 tags as you broaden. Altering a tool’s tag strikes it to a different group and profile.

Creating and Assigning the Deployment Profile

The deployment profile decides how the gadget behaves on first power-on: it units the deployment mode and customizes the out-of-box expertise (OOBE) customers see. Create one below Home windows Autopilot > Deployment Profiles > Create Profile > Home windows PC, per the profile configuration documentation. The scripted equal is a POST /deviceManagement/windowsAutopilotDeploymentProfiles name by way of Invoke-MgGraphRequest with the DeviceManagementServiceConfig.ReadWrite.All scope; confirm the outcome afterward with Get-MgBetaDeviceManagementWindowsAutopilotDeploymentProfile. The profile sits in the midst of a sequence that begins on the manufacturing facility picture and ends at a managed desktop, as you possibly can see under.

Out-of-Field Expertise Settings

On the Out-of-box expertise (OOBE) web page, choose Person-driven for Deployment mode when an individual indicators in throughout setup, or Self-deploying for shared units, kiosks, and digital signage; self-deploying authenticates with the TPM, so it fails on VMs and {hardware} with out a actual TPM 2.0. For the standard company laptop computer, configure the remainder like this:

The OOBE web page seems to be like this as soon as each setting above is utilized, as proven under.

Assigning the Profile and Studying Profile Standing

On the Assignments web page, assign the profile to your gadget group with Chosen teams. If a tool falls into a number of profiles, the oldest created profile wins. If you happen to allow Convert all focused units to Autopilot on the Fundamentals web page, each company gadget already enrolled in Intune contained in the assigned teams registers for the Autopilot service robotically. Permit as much as 48 hours for that registration, per Microsoft’s deployment profile documentation; disabling the setting later doesn’t unregister these units.

After project, return to the Home windows Autopilot units record and watch Profile standing transfer from Unassigned to Assigning to Assigned, then verify Date assigned is populated. Deploying earlier than that date is ready is the traditional “I registered it, why did nothing occur” mistake: the profile had not reached the gadget.

Configuring the Enrollment Standing Web page

The ESP is the progress display customers watch whereas provisioning finishes, and it retains the gadget off the desktop till each required app and profile finishes putting in, per Microsoft’s ESP overview. Configure it below Units > Enrollment > Home windows Autopilot > Enrollment Standing Web page > Create. The scripted equal is a POST /deviceManagement/deviceEnrollmentConfigurations name by way of Invoke-MgGraphRequest with an @odata.sort of #microsoft.graph.windows10EnrollmentCompletionPageConfiguration and the DeviceManagementServiceConfig.ReadWrite.All scope; record the outcome afterward with GET /deviceManagement/deviceEnrollmentConfigurations.

Core ESP Settings

The settings that matter most for a primary rollout, per the ESP profile documentation:

Selecting Blocking Apps and Timeout Math

Each blocking-list app should end earlier than the person reaches the desktop, so every addition stretches provisioning and widens the timeout-failure window. Maintain the record to necessities: the VPN shopper, your administration agent, and one or two line-of-business apps the person can not work with out. Every little thing else installs within the background after the desktop seems.

Professional Tip: If Microsoft 365 Apps is in your blocking record, deploy it as a Win32 app. Microsoft paperwork that the built-in Microsoft 365 Apps app sort can dangle the ESP when the Workplace installer runs whereas one other tracked Win32 app is putting in.

Match the timeout to what you block: with Workplace and a VPN shopper tracked, a 60-minute default can fail late on sluggish connections, forcing a full enrollment restart. Set 90 minutes for pilot runs, measure actual provisioning time, then tune down. Additionally determine whether or not the ESP seems for each new sign-in or solely throughout OOBE; on shared {hardware}, OOBE-only retains later customers out of a setup display they don’t want. You’ll discover the timeout, the blocking record, and the sign-in show setting collectively on the identical web page of the ESP profile, as proven under.

Deploying Apps and Insurance policies Forward of First Signal-In

The profile and ESP outline how provisioning runs, however the apps and insurance policies delivered throughout it come out of your regular Intune assignments. Software program project works the identical because it at all times has, and Autopilot installs these apps throughout enrollment.

Solely apps assigned as Required to the gadget group or the enrolling person are candidates; obtainable apps await the Firm Portal. Solely blocking-list apps are assured to complete earlier than the desktop seems; different required apps set up within the background. Assign blocking apps to the gadget group the place you possibly can, as a result of device-context set up completes throughout the gadget setup section, earlier than person apps start.

Packaging Apps for Dependable Provisioning

Favor Win32 apps with detection guidelines over line-of-business (LOB) installers for something past a silent MSI. Win32 apps provide you with set up instructions, return-code dealing with, and detection logic, which is what an app must provably end earlier than the ESP marks it full. Microsoft 365 Apps, your VPN, and agent software program belong on this class, and Microsoft’s ESP steering particularly recommends Win32 packaging for Microsoft 365 Apps over the built-in app sort to keep away from provisioning hangs. Assign safety profiles, like BitLocker and Home windows Defender, to the gadget group so that they apply throughout the gadget section, earlier than the person indicators in for the primary time.

Intune retains making use of assignments after enrollment, so heavy software program rides alongside post-setup. When provisioning feels sluggish, begin by shortening the blocking record earlier than you blame the community.

Deploying and Verifying a Home windows 11 Autopilot Pilot

Portal configuration means nothing till an actual gadget walks the trail, so run one machine by way of the complete expertise earlier than saying a rollout. This assumes the sooner steps are accomplished so as, per the user-driven Microsoft Entra be part of workflow: enrollment configured, gadget registered, profile and ESP assigned, and Profile standing displaying Assigned.

Working the First Deployment

Reset the gadget to its out-of-box state, or unbox a recent one, and energy it on. First screens are language, area, and keyboard, then the community immediate; on a wired connection little interplay is required. As soon as networked, the gadget contacts the Autopilot service, acknowledges its {hardware} hash, and downloads your profile, which replaces client setup screens along with your firm sign-in web page. Check in with the check person’s Entra ID credentials, full any MFA your Conditional Entry insurance policies demand, and the ESP takes over: the gadget joins Entra ID, enrolls in Intune, and strikes by way of gadget setup and account setup when you watch the progress indicators.

If you happen to reset a tool that already enrolled as soon as, delete its document in Intune first, or the redeployment fails with the 0x80180014 error lined within the troubleshooting part. And if the sign-in web page by no means seems and the gadget falls into client setup, the machine isn’t registered, its profile isn’t assigned, or Date assigned was empty while you began; each a kind of is a portal-side repair.

Verifying the Deployment

Affirm every of the next earlier than calling the pilot clear, even after the ESP completes:

• The gadget seems in Intune below Units > Home windows, enrolled along with your check person as major person, and in Entra ID as Microsoft Entra joined with an enrollment date matching the pilot run.

• The Home windows Autopilot deployment standing report, below Units > Monitor, reveals the anticipated outcome and retains 30 days of historical past, per Microsoft’s Intune reporting documentation.

• Blocking apps are put in, BitLocker experiences encryption energetic, and the compliance coverage marks the gadget compliant.

Run the pilot on one laptop computer per vendor and mannequin household earlier than scaling. A golden picture hid OEM firmware variations by delivery the identical examined driver set to each mannequin, and Autopilot doesn’t, so log provisioning time per mannequin as your troubleshooting baseline.

Reprovisioning Home windows 10-Period {Hardware}

Home windows 10’s October 2025 finish of assist most likely pushed you right into a Home windows 11 refresh, and Autopilot handles the present half of that fleet. Units already enrolled in Intune and registered by way of the Convert all focused units to Autopilot setting could be reprovisioned remotely with Home windows Autopilot Reset, which wipes private recordsdata, apps, and settings whereas preserving Entra ID and Intune enrollment. For unregistered machines, export the hash from Settings and import it as proven earlier; the following reset enrolls the gadget in Intune. Roll the refresh out in rings, selling units by altering their group tag when every ring validates.

Troubleshooting Frequent Autopilot Failures

Most Autopilot failures present up within the error code earlier than you open a log. The desk maps the codes you’re almost definitely to see, drawn from Microsoft’s identified points and troubleshooting documentation:

The place the Logs Cover

The occasion logs carry the element the error code leaves out. For registration and be part of points, test Occasion Viewer > Functions and Companies Logs > Microsoft > Home windows > Person System Registration > Admin. The Intune Connector for Lively Listing logs below Microsoft > Intune > ODJConnectorService, and provisioning occasions land within the DeviceManagement-Enterprise-Diagnostics-Supplier log. The ESP setup documentation additionally flags an ESP caught on “Figuring out” when the signed-in person has no Intune license; when you enabled log assortment within the ESP profile, the failed gadget can export diagnostics from the error display.

Diagnosing the “System Did Nothing” Grievance

The commonest report carries no error code in any respect: the gadget boots straight into client setup. Work the chain so as: is the gadget listed below Home windows Autopilot units, does Profile standing present Assigned with a Date assigned, and was the hash collected on this precise {hardware} state, since a motherboard substitute invalidates it? If all three move, test the Person System Registration occasion log. Typically the gadget was by no means registered, or the profile project hadn’t completed when the field was powered on.

Regularly Requested Questions

Can I take advantage of Autopilot for Home windows 11 units my group already owns? Sure. Current {hardware} registers by way of the identical hardware-hash import used for brand new units, from the PowerShell script or Settings, so you possibly can deploy Home windows 11 with Autopilot on machines you already personal. Home windows 10-era machines headed to Home windows 11 can register first after which reset, or use Autopilot Reset if already Intune-managed.

What’s the distinction between traditional Home windows Autopilot and Autopilot gadget preparation? Traditional Autopilot registers {hardware} by hash and targets units by way of dynamic teams, whereas Home windows Autopilot gadget preparation makes use of Enrollment Time Grouping so as to add the gadget to a safety group at sign-in and skips the hash requirement. System preparation is Home windows 11 solely and helps cloud-only be part of, so when you want hybrid be part of, you will need to keep on traditional Autopilot.

Does Home windows Autopilot require a VPN throughout deployment? Solely on the hybrid path. Cloud-only be part of wants plain web entry. Hybrid be part of requires the Intune Connector for Lively Listing and line of sight to a website controller throughout OOBE, which distant customers sometimes fulfill with an always-on VPN.

Which license does the individual unboxing the gadget want? An Intune license on the enrolling person is necessary, and the tenant wants Microsoft Entra ID P1 or P2 for computerized enrollment configuration. Microsoft 365 Enterprise Premium is the same old SMB reply as a result of it bundles each.

Subsequent Steps

The pilot gadget is working, so the numbers it produces determine how briskly the rollout widens. Measure provisioning time on each new {hardware} mannequin earlier than mass deployment, since a mannequin that runs previous the ESP timeout fails silently for each person in that ring. Overview the deployment standing report weekly for the primary month, whereas the rollout remains to be sufficiently small to repair rapidly. Then promote every ring by altering its group tag from AutopilotPilot to AutopilotRing1.

Associated: Migrate Group Coverage to Intune With out Breaking Endpoints and Defend Your Endpoints with Microsoft Intune stroll the 2 tasks that make a cloud-only Autopilot rollout attainable: coverage migration off the area, and the Intune baseline ready to your units after enrollment.