Setup Autopilot Device Preparation in Intune

In this post, I’ll show you how to setup Autopilot Device Preparation in Intune. Windows Autopilot Device Preparation is Microsoft’s newer, streamlined approach to provisioning Windows 11 PCs. It delivers a faster, more consistent setup experience with near real-time reporting and simpler troubleshooting.

The official Microsoft name for this feature is Windows Autopilot Device Preparation. In the tech community, it’s sometimes referred to as Autopilot v2, but both terms describe the same solution. You may already be familiar with Windows Autopilot, often called Autopilot v1. It’s important to understand that these are two separate solutions aimed at achieving the same goal but with different use cases. Windows Autopilot Device Preparation is not an extension or direct successor to Windows Autopilot.

For a detailed step-by-step guide on Windows Autopilot (v1) setup. See: Windows Autopilot Setup Guide [Step-by-Step].

In the following sections of this post, I’ll highlight the core features of Windows Autopilot device preparation, review the prerequisites, and then walk through the step-by-step setup and configuration process.

Windows Autopilot vs. Windows Autopilot Device Preparation

Features of Windows Autopilot Device Preparation

Windows Autopilot Device Preparation is a provisioning method for Windows 11 devices that streamlines the Out-of-Box Experience (OOBE) for users. Users have a better onboarding experience and can get to the desktop faster when compared with Windows Autopilot. Below are some core features of the Windows Autopilot Device Preparation method.

• Simplified OOBE: While it is not a replacement for the Windows Autopilot ESP, the process is much more streamlined. During setup, you will see a percentage-based progress indicator for app and script installations, followed by a message stating Required setup is complete.

• Enrollment Time Grouping: When a user signs in during OOBE, the device is automatically added to a special Entra security group (we will create this group during setup/configure stage). Any applications or scripts assigned to this group are installed on the device immediately, before the user reaches the desktop.

• Support for PowerShell scripts: You can run up to 10 PowerShell scripts during the OOBE process. This is useful for configuring devices and apps that require registry changes, custom file permissions, or enabling and disabling specific Windows features.

• Near Real time reporting: Near real-time reporting shows per-app and per-script status with easy diagnostics export.

• Standard User Default: By default, the profile sets up the user with standard rights. You can switch this to administrator using a toggle, but it is recommended to keep the default setting and use Intune Endpoint Privilege Management for on-demand elevation.

• Autopilot Device Preparation works only on supported Windows 11 builds and should not be mixed with classic Autopilot on the same device. If a device is assigned both an Autopilot deployment profile and an Autopilot Device Preparation profile, the Autopilot profile will take precedence.

• Support for Government Community Cloud (GCC): Windows Autopilot Device preparation method supports both commercial and government (Government Community Cloud (GCC) High, and U.S. Department of Defense (DoD)) organizations and agencies.

• Microsoft Entra Join only: Autopilot Device Preparation works only with Microsoft Entra Join devices. As of now, Microsoft Entra hybrid join is not supported. If you want to Entra hybrid join, then you can use Windows Autopilot (v1).

Prerequisites

Let’s look at the prerequisites for implementing Autopilot device preparation.

• Windows OS version:
  • Windows 11, version 24H2 or later.
  • Windows 11, version 23H2 with KB5035942 or later (Windows 11, version 23H2 installation media dated April 2024 or later has KB5035942 included).
  • Windows 11, version 22H2 with KB5035942 or later (Windows 11, version 22H2 installation media dated April 2024 or later has KB5035942 included). For more details, refer here: software#windows-11.

Autopilot device preparation does not support Windows 10 devices.

• License Requirements:
  • Microsoft 365 Business Premium subscription
  • Microsoft 365 F1 or F3 subscription
  • Microsoft 365 Academic A1, A3, or A5 subscription
  • Microsoft 365 Enterprise E3 or E5 subscription
  • Enterprise Mobility + Security E3 or E5 subscription
  • Intune for Education subscription.
  • Microsoft Entra ID P1 or P2 and Microsoft Intune subscription. For more details, refer here: #licensing-requirements.

• Networking requirements: See the page, #networking-requirements.
• RBAC requirements: See the page, #rbac-requirements. For creating a custom role in Intune, see Creating custom role in intune.

Getting Ready

1. Ensure that users are allowed to join their devices to Microsoft Entra ID. Go to Microsoft Entra admin center > Devices > Device settings and set Users may join devices to Microsoft Entra to All or Selected. If you choose Selected, select a Microsoft Entra group that contains the users who are allowed to join their devices to Microsoft Entra ID.

2. Go to Microsoft Entra admin center > Mobility (MDM and MAM) > Microsoft Intune and configure the MDM user scope. Set the scope to All or Some. If you select Some, select a Microsoft Entra group that contains the users whose devices should be automatically enrolled into Intune. This configuration ensures that devices are automatically enrolled into Intune after they are joined to Microsoft Entra ID.

Configure Autopilot Device Preparation

Follow the steps below to setup and configure Windows Autopilot device preparation in Intune.

1. Create a User Group

Create a Microsoft Entra security group that contains the users who will receive the Windows Autopilot device preparation profile. For the demo, I have created a security group named DP-Autopilot-Users and will use it to assign the Autopilot device preparation policy. This group can have assigned group or a dynamic group membership.

2. Create a Device Group

You’ll also need a Microsoft Entra device security group to target the devices that will use Windows Autopilot device preparation. In this example, I have created a device security group named DP-Autopilot-Devices. It must have a membership type of Assigned; it cannot be a dynamic group.

Next, add the owner of this device security group to either the Intune Autopilot ConfidentialClient or Intune Provisioning Client enterprise application. Verify that the Application (Client) ID displayed is f1346770-5b25-470b-88bd-d5744ab7952c before adding the group owner.

3. Assign Apps and Scripts to the Device Group

Windows Autopilot device preparation allows you to install up to 25 applications and run up to 10 PowerShell scripts during the out-of-box experience (OOBE). Before creating the deployment profile, decide which essential applications and scripts should be installed on the device before the user signs in for the first time.

Assuming the required Intune app deployments and PowerShell scripts have already been created, edit the assignments for each application and add the DP-Autopilot-Devices device group (created in the previous step) to the Required assignment. Repeat the same process for each PowerShell script that you want to run during device preparation.

4. Create Autopilot Device Preparation Profile

• Sign in to the Intune admin center, then go to Devices > Windows > Enrollment > Device preparation policies.

• Click Create > User Driven.

• On the Introduction page, click Next.
• On the Basics tab, provide a name and description of the deployment profile. For example: DP-Autopilot-Profile.
• Device group: Search and add the device group (DP-Autopilot-Devices) we created in Step 2.

• Configuration settings:
  • Deployment mode: User-driven
  • Deployment type: Single user
  • Join type: Microsoft Entra joined
  • User account type: The toggle switch is off by default, which means the user enrolling the device will be set as a standard user. If you want the user to have administrator rights, enable the switch. I recommend keeping it off.

• Out-of-box experience settings:
  • Minutes allowed before showing installation error: Enter the number of minutes allowed before a deployment is considered failed. This value applies to the entire deployment, not to individual application installations or PowerShell scripts. The acceptable range is an integer between 15 and 720.
  • Custom error message: Provide a custom error message to display when the deployment fails. For example, you can add service desk/help desk number.
  • Allow users to skip setup after multiple attempts: Keep it enabled.

Allow users to skip setup after multiple attempts: Use the toggle switch and either set it to Yes or No. After a deployment failure, a Retry button is normally displayed, allowing the end user to attempt the deployment again. If this option is set to Yes, a Continue anyway button is also shown, which lets the user skip the deployment, sign in, and continue to the desktop.

• Show link to diagnostics: Set this to Yes; it will display a link to collect diagnostic logs when a deployment fails. If it’s set to No, the link for diagnostics will not be shown to the user.

• You can add up to 25 managed applications and 10 Windows PowerShell scripts that you want to install on the device during OOBE. Decide on which apps and scripts are most essential in your organization and add them to the Autopilot device preparation profile.

As per the January 30, 2026 update, you can now configure up to 25 apps to install during Autopilot device preparation. For more information, refer to the link: What’s new in Windows Autopilot device preparation | Microsoft Learn.

Applications and scripts added to the Autopilot Device Preparation profile must be assigned to the device group created earlier (DP-Autopilot-Devices). Also, ensure that the apps and scripts are deployed in the system context.

• Scope tags (optional): A scope tag in Intune is an RBAC label you add to resources (policies, apps, devices) to limit which admins can see and manage them. For more Information, read: How to use scope tags in Intune.
• Assignments: Assign the deployment profile to DP-Autopilot-Users group.
• Review + create: Review the deployment summary and click Save.

That’s it! The configuration is now complete. Let’s now walk through the out-of-box experience (OOBE) on a test device and see how Windows Autopilot device preparation works in practice. In the following section, I’ll demonstrate the setup process and the screens that users will see while setting up their device.

Windows Autopilot device preparation does not currently support a device name template. Therefore, the device retains its automatically generated Windows name after enrollment. If your organisation uses a standard device naming convention, configure a separate post-enrollment process using an Intune device rename action, bulk device action, PowerShell script, or remediation script. Intune bulk rename action supports variables such as {{serialnumber}} and {{rand:x}}.

Add Corporate Device Identifiers

For Windows Autopilot device preparation to work successfully, ensure that your device platform restrictions policy allows personally owned Windows devices. If you don’t want to allow personally owned devices, you must add serial number of the device under Corporate Device Identifiers in Intune before enrollment. This enables Intune to recognize the device as organization-owned during the enrollment process.

Corporate Device Identifiers allow Microsoft Intune to distinguish organization-owned devices from personally owned devices during enrollment. This is particularly important when enrollment of personally owned devices is blocked. For Windows devices, upload the serial number of each device before enrollment so that Intune can correctly identify them as corporate-owned.

• Go to Intune admin center > Devices > Enrollment. Click on Add and select either Upload CSV file or Enter manually.

For CSV, enter the data in the file as shown below and upload the file to add the corporate device identifier in bulk.

Microsoft,Surface Laptop 5,01234567890123
Lenovo,ThinkPad T14,02234567890123

If you are adding Corporate Device Identifiers manually, select Serial number as the Serial identifier type. Enter the device’s serial number in the Identifier field and click Add to save the device identifier.

End User Experience

Let’s walk through the Out-of-Box Experience (OOBE) from an end user’s perspective and see the steps involved in setting up a device using Windows Autopilot device preparation.

If you are using an existing device, perform a factory reset before starting the enrollment. To do this, open Settings, search for Reset this PC, and follow the reset process. If you are using a brand-new device that is already displaying the Out-of-Box Experience (OOBE) screen, there is no need to reset it again.

For detailed instructions on resetting a Windows device, refer to the post How To Factory Reset A Windows 11 PC.

• Select your country or region, then click Yes.

• Select a keyboard layout, then click Yes.

• Add a second keyboard layout or click on Skip to proceed to the next step.

• Click Accept on the Please review the license agreement screen.

• Do not provide a device name; click Skip for now.

• Check for updates screen. This screen took around a minute for me and automatically proceeded further without any action.

• Do not enter your name; instead, click on Even better, use an online account link.

• On the below screen, select Set up for work or school. Do not select Set up for personal use.

• In the next screen, you will be asked to enter your credentials. Enter your email address, for example, jatin2@cloudinfra.net and password.

• You may see different screens depending on your account. For example, if your password has expired or an administrator has reset it and requires you to change it at the next logon, you will be prompted with the Update your password screen.

• If it’s a brand-new account that has never signed in to any service before, you will be prompted to set up multi-factor authentication (MFA). Follow the steps to configure and complete the authentication process.

• Please wait while we set up your device screen.

• The Windows Autopilot device preparation process will begin and display a progress screen showing the overall completion percentage. The first step is the installation of the Intune Management Extension, which is required before the assigned applications and PowerShell scripts can be installed during the provisioning process.

• After the Intune Management Extension is installed, Windows Autopilot device preparation proceeds with installing all the applications and running the PowerShell scripts that you assigned to the Autopilot device preparation profile.

• After all the assigned applications have been installed and the PowerShell scripts have run successfully, the Required setup is complete screen is displayed, indicating that the device is ready for use.

• In the next set of screens, you will be prompted to configure various Windows features and privacy settings. Review each option carefully, configure the settings based on your organization’s requirements, and click Accept to continue.
• In this guide, I will select the options based on my test environment. However, in a production environment, you should follow the guidance provided by your IT administrator or your organization’s policies when configuring these settings.

• Let Microsoft and apps use your location: No

• Find my device: No

• Send diagnostic data to Microsoft: Required only.

• Improve inking & typing: No

• Get tailored experiences with diagnostic data: No

• Windows will now begin setting up the user profile. During this process, you will see the screens shown below while Windows completes the final configuration.

• Windows is setting up your user profile. Please wait.

• If your organization has enabled Windows Hello, you will be presented with the screens shown below. On the Use Windows Hello with your account screen, click OK to continue to the next step.

• A pop-up window will appear prompting you to sign in. Enter your account credentials, complete the multi-factor authentication (MFA) process if prompted, and then continue to the next step.

• Setup your device PIN and click Ok.

• Windows Hello configuration is completed.

• Finally, you will arrive at the Windows desktop, where all the essential applications assigned through the Windows Autopilot device preparation profile will already be installed. In the screenshot below, you can see desktop shortcuts for applications such as RingCentral and WinSCP. Additional desktop shortcuts were also created by the PowerShell script that ran during the Out-of-Box Experience (OOBE).

• Not all applications create a desktop shortcut after installation. To verify that the remaining applications were installed successfully, open the Start menu and search for them. In this example, applications such as Android Studio and Google Drive are available in the Start menu, confirming that they were installed successfully during Windows Autopilot device preparation.

• I have successfully provisioned two Windows devices using the Windows Autopilot device preparation profile. As shown below, both devices were automatically added to the DP-Autopilot-Devices Microsoft Entra device group, confirming that the group membership was updated successfully during the provisioning process.

Conclusion

In this post, we walked through the step-by-step process of setting up and configuring a Windows Autopilot device preparation profile. The overall experience was smooth, with a fast and streamlined Out-of-Box Experience (OOBE).

One of the key advantages of Windows Autopilot device preparation is that it supports the installation of both Line-of-Business (LOB) and Win32 applications during OOBE. This is not supported with the original Windows Autopilot (v1) deployment experience, where combining LOB and Win32 applications during provisioning isn’t supported.

For a detailed comparison of the two provisioning methods, refer to the guide Windows Autopilot Vs. Windows Autopilot Device Preparation.