Windows Autopilot lets IT ship a new Windows device straight from the vendor to an employee, who signs in with their work account and gets a fully configured, secured and managed PC without IT ever touching it. Autopilot works with Microsoft Intune and Microsoft Entra ID to join the device, apply policies and install apps during the out-of-box experience. Microsoft now offers two versions, classic Windows Autopilot and Windows Autopilot device preparation, and choosing the right one is the first step in any deployment.
Key Takeaways
- Autopilot replaces traditional imaging with cloud-driven provisioning over the internet.
- Classic Autopilot requires device registration and supports user-driven, pre-provisioned, self-deploying and hybrid join scenarios.
- Autopilot device preparation needs no device registration but supports fewer scenarios and only Entra join.
- Get identity, Intune enrollment, apps and policies right before the first device ships.
- Pilot with a small group, then scale through your hardware vendor or reseller.
How Windows Autopilot Works
At a high level, every Autopilot deployment follows the same flow:
- The device is linked to your tenant, either through registration (classic) or association during enrollment (device preparation).
- The user unboxes the device, connects to the internet and signs in with their Microsoft Entra ID account.
- The device joins Entra ID and enrolls automatically in Intune.
- Intune applies configuration profiles, security baselines, compliance policies and required apps.
- The user lands on a ready-to-use desktop, and IT can manage, update and wipe the device remotely from then on.
Because nothing is imaged locally, Autopilot also makes it easier to support remote employees, refresh hardware and reset devices for a new user.
Classic Autopilot vs Autopilot Device Preparation
| Feature | Classic Windows Autopilot | Autopilot device preparation |
|---|---|---|
| Device registration | Required (hardware hash or vendor/partner registration) | Not required |
| Scenarios | User-driven, pre-provisioned, self-deploying, existing devices | User-driven and automatic |
| Join type | Entra join and Entra hybrid join | Entra join only |
| Configuration | Deployment profile plus Enrollment Status Page | Device preparation policy plus a device security group |
| Apps during setup | Up to 100 apps | Up to 25 essential apps and 10 PowerShell scripts |
| Windows version | Supported Windows 10 and Windows 11 versions | Windows 11 24H2 or later (or 22H2/23H2 with the required update) |
Choose classic Autopilot if you need hybrid join with on-premises Active Directory, pre-provisioning by a partner, kiosk or shared devices (self-deploying), or Windows 10 support.
Choose Autopilot device preparation if you are cloud-only, standardized on Windows 11, and want a simpler setup with no hardware hash management and clearer deployment reporting.
Prerequisites Checklist
- Licensing: Microsoft Intune and Entra ID P1, included in Microsoft 365 Business Premium, E3 and E5. See our license comparison if you are unsure.
- Automatic enrollment: Enable Intune MDM automatic enrollment for the users or groups that will receive devices.
- Branding: Configure company branding in Entra ID so users recognize the sign-in screen.
- Network: Make sure the required Microsoft endpoints are reachable from home and office networks.
- Device supply: Ask your hardware vendor or reseller to register devices to your tenant (classic) or confirm Windows 11 versions (device preparation).
Step-by-Step Deployment Plan
- Define your standard build. Decide the security baseline, BitLocker settings, Windows Update rings, Defender settings and the small set of apps users need on day one.
- Prepare Intune policies. Create configuration profiles, compliance policies and app assignments. Keep the apps installed during setup to the essentials and deliver the rest after sign-in.
- Create the Autopilot profile or policy. For classic Autopilot, create a deployment profile and Enrollment Status Page. For device preparation, create the device security group and device preparation policy.
- Link devices. Register devices through your vendor or upload hardware hashes for existing PCs (classic), or assign users to the device preparation policy.
- Pilot. Test with IT staff and a few business users on each hardware model, both in the office and on home Wi-Fi.
- Roll out in waves. Combine Autopilot with your hardware refresh or Windows 11 migration, and update your onboarding and offboarding checklist so new hires receive devices this way by default.
Common Autopilot Mistakes
- Too many apps during setup. Large app sets slow provisioning and cause timeouts. Install only what is essential before the desktop appears.
- Skipping hybrid join planning. Hybrid join adds complexity and network dependencies. Move to Entra join where your applications allow it.
- No pilot per hardware model. Drivers and firmware differ between models. Test each one.
- Forgetting existing devices. Existing PCs need hardware hashes uploaded or a reset path, especially if you are still moving from Configuration Manager. See Intune vs SCCM for co-management options.
How Skytech Enterprise Helps
Our Intune and Autopilot device deployment service designs your standard build, configures Autopilot and pilots it with your hardware vendor. After go-live, Intune endpoint management keeps devices patched and compliant for organizations in the USA and UAE. Talk to our endpoint team.
Frequently Asked Questions
What is Windows Autopilot?
Windows Autopilot is a Microsoft service that sets up new or reset Windows devices automatically through Intune and Entra ID, so users can sign in and receive a fully configured work PC without manual imaging.
What is the difference between Windows Autopilot and Autopilot device preparation?
Classic Autopilot requires devices to be registered first and supports more scenarios, including hybrid join and pre-provisioning. Autopilot device preparation does not require registration, supports only Entra join and Windows 11, and offers simpler configuration and reporting.
Do I need a hardware hash for Windows Autopilot?
For classic Autopilot, devices must be registered, which is usually done by the hardware vendor or reseller or by uploading a hardware hash. Autopilot device preparation does not require registration.
Can Autopilot be used on existing devices?
Yes. Classic Autopilot supports existing devices through hardware hash upload or the existing devices scenario. Devices are typically reset and then provisioned through Autopilot.
What licenses are required for Windows Autopilot?
You need Microsoft Intune and Microsoft Entra ID P1 with automatic enrollment, which are included in Microsoft 365 Business Premium, E3 and E5.
How long does an Autopilot deployment take?
Provisioning a single device usually takes 20 to 60 minutes depending on apps and network speed. Designing and piloting an Autopilot rollout typically takes two to six weeks.