Windows Autopilot Explained: Classic vs Device Preparation

A new laptop costs money; getting it ready costs time. The old way: the box arrives at IT, someone unpacks it, wipes it, installs a company image, adds drivers, apps and settings, packs it again and ships it. One laptop takes a few hours, a hundred take weeks.

Windows Autopilot flips that around. The laptop goes from the vendor straight to the user, still sealed. They switch it on, connect to Wi-Fi, sign in with their work account, and the cloud does the rest. No image, no IT desk in the middle. Here’s what happens behind that sign-in screen.

The building blocks

Autopilot isn’t one product. It’s a few Microsoft services, each with one job:

• Windows. Autopilot keeps the Windows that came on the device and turns it into a company PC during setup (the out-of-box experience).
• Microsoft Entra ID is the identity. When the user signs in, the device joins your tenant (what a join is).
• Microsoft Intune is the management. Right after the join, the device enrolls and Intune sends apps, settings and security policies.
• The Autopilot service ties it together, telling the device during setup that it belongs to you and how to set it up.

Before any of that works:

1. Users need licenses that include Microsoft Entra ID P1 and at least Intune Plan 1. Check Microsoft Learn for the current requirements.
2. Automatic enrollment must be on in Intune, so a device that joins Entra also enrolls. It’s one of the five ways to enroll Windows.
3. The user who signs in must be allowed to join devices to Entra ID.

Today there are two flavors: classic Windows Autopilot and Windows Autopilot device preparation.

Two flavors, side by side

	Classic Autopilot	Autopilot device preparation
Registration	Every device registered first (hardware hash)	None
Setup objects	Deployment profile + Enrollment Status Page	One policy assigned to users, plus a device group
Windows	Windows 10 and 11	Windows 11 only
Join type	Entra join or hybrid join	Entra join only
Modes	User-driven, self-deploying, pre-provisioning, existing devices	User-driven, plus automatic mode for Windows 365

You can use both in the same tenant, but one device runs only one. If a device is registered for classic Autopilot, the classic profile wins, except for associated devices (see below).

Classic Autopilot, step by step

1. Registration. The hardware hash is a fingerprint built from the manufacturer, model and serial numbers. Your vendor or reseller can upload it when you buy, or IT can capture and upload it as a file.
2. The profile. You assign a deployment profile to a device group, often a dynamic group based on a group tag. The device has to land in that group before it gets the profile.
3. First boot. The device goes online and asks the Autopilot service who it belongs to. Setup skips the screens you don’t need and shows your company’s sign-in.
4. The Enrollment Status Page. After sign-in it tracks three phases: device preparation, device setup and account setup. The user waits until the apps and policies you marked as required are installed. Then the desktop.

Classic also has three other modes:

• Self-deploying for kiosks and shared devices, with no user sign-in during setup.
• Pre-provisioning: a technician or partner presses the Windows key five times, installs the device apps in advance and reseals the box, so the user’s part is shorter.
• Existing devices: Configuration Manager reinstalls Windows on PCs you already have and sends them through Autopilot.

Device preparation, step by step

1. Two groups. A device group owned by a Microsoft service called the Intune Provisioning Client, and a user group with the people who’ll set up their own PCs.
2. One policy, assigned to the user group. It names the device group and the apps and scripts that must install during setup: up to 25 apps and 10 scripts.
3. The user signs in. With no registration, the device doesn’t know your company yet. Intune finds the policy through the user, the device joins Entra, enrolls in Intune and lands in the device group right away (enrollment time grouping). No waiting for a dynamic group.
4. Setup. No Enrollment Status Page: the user sees one screen with a percentage while the selected apps and scripts install. If one fails, setup fails, unless you allowed users to continue anyway.

Then the desktop, and the other apps and policies arrive in the background.

Trusting the device

Many companies block personal Windows devices from enrolling. Without registration, how does Intune know a new laptop is corporate?

• Corporate identifiers. Upload the manufacturer, model and serial number of devices you bought, and Intune treats them as corporate when they enroll. Only needed if you block personal devices.
• Device association (new). It ties a physical device to your tenant before anyone signs in, using a marker in the firmware that the TPM can prove. An associated device is marked corporate automatically and unlocks extras like a naming template and customized setup screens. It needs a recent Windows 11 update and real hardware with TPM 2.0; virtual machines aren’t supported.

After the first boot

• Windows 365: device preparation’s automatic mode is picked in the Cloud PC provisioning policy, so the Cloud PC is set up before the user ever signs in.
• Reporting: device preparation has a near real-time report in Intune with each device, its apps and scripts, and how long setup took.
• Autopilot Reset (classic) wipes the user’s files, apps and settings but keeps the device joined and enrolled, ready for the next person. Trigger it from the lock screen with Ctrl + Windows + R once a policy allows it, or remotely from Intune.
• Retiring a device: delete it from Intune first, then from the Autopilot devices list. Otherwise the next owner’s PC still thinks it belongs to you.

Recap

The device comes from the vendor, sealed. The user signs in. Entra knows who they are, Intune sets up the device, and Autopilot tells it whose it is. Classic registers every device first and does more; device preparation needs no registration and keeps things simple, on Windows 11.

What’s the longest an Autopilot setup has ever taken for you? Tell me in the comments.