How do I configure Microsoft Entra joined devices using Windows Autopilot?

Overview

This article outlines the steps to configure Microsoft Entra joined devices using Windows Autopilot. This method is suitable for units that want to provision and manage Windows devices through Microsoft Intune without joining the devices to an on-premises Active Directory domain.

For enrolling devices that are already bound to on-Premise Active Directory, or that you might want to have on AD, you'll want to use Hybrid joined, see:

It also supports scenarios where a vendor registers a Windows Autopilot device on behalf of the unit using a group tag, enabling streamlined device grouping and policy assignment during provisioning.

Step 1: Capture Hardware Hashes (if not vendor registered)

If a device was not already registered by a preferred vendor, open PowerShell as an administrator and determine whether the Get-WindowsAutopilotInfo.ps1 script is already available:

Get-Command Get-WindowsAutopilotInfo.ps1 -ErrorAction SilentlyContinue

If the script is available, PowerShell will return information about the command. If no results are returned, install the script from the PowerShell Gallery:

Install-Script -Name Get-WindowsAutopilotInfo.ps1 -Force

If PowerShell does not recognize the PowerShell Gallery name with the .ps1 extension, run the installation command without the extension:

Install-Script -Name Get-WindowsAutopilotInfo -Force

Once the script is available, use the following command to capture the hardware hash and upload it directly to Microsoft Intune:

Get-WindowsAutopilotInfo.ps1 -Online

The -Online parameter launches a Microsoft authentication window. Sign in using an account with sufficient privileges to register Windows Autopilot devices. After authentication succeeds, Get-WindowsAutopilotInfo.ps1 captures the hardware hash and uploads the device information directly to Microsoft Intune.

You can include a group tag during the online upload:

Get-WindowsAutopilotInfo.ps1 -Online -GroupTag "Marketing"

The person running the command must have sufficient privileges to upload the device to Windows Autopilot, and the device must have Internet access.

If the person running the command does not have sufficient privileges to upload the device directly, or if the device does not currently have Internet access, save the hardware hash to a CSV file instead:

Get-WindowsAutopilotInfo.ps1 -OutputFile "C:\AutopilotHWID.csv"

You can also include a group tag when creating the CSV file:

Get-WindowsAutopilotInfo.ps1 -OutputFile "C:\AutopilotHWID.csv" -GroupTag "Marketing"

Transfer the CSV file to a device with Internet access, if necessary, and upload it to Microsoft Intune under:

Intune > Devices > Windows > Windows Enrollment > Devices > Import

Step 2: Assign a Group Tag

Assign a Group Tag to the imported devices to associate them with a specific Windows Autopilot deployment profile. The group tag is used to dynamically group devices in Microsoft Entra ID.

The tag does not already have to exist but should be unique to your unit and appropriate for your device grouping and provisioning use case. If you provided the -GroupTag parameter when running Get-WindowsAutopilotInfo.ps1, this step is already satisfied.

Step 3: Create a Dynamic Device Group

Create a device group in Microsoft Entra ID and initially leave the Membership type as Assigned.

Submit a request and provide the name of the group and the group tag that you would like to use. The group can then be changed to Dynamic device membership using the Windows Autopilot Group Tag as the membership criteria.

Step 4: Create and Assign a Deployment Profile

Create a Windows Autopilot deployment profile:

  1. Navigate to Intune > Devices > Enrollment > Windows Autopilot > Deployment Profiles.
  2. Set Deployment Mode to User-Driven.
  3. Configure Join to Microsoft Entra ID as to Microsoft Entra joined.
  4. Configure the remaining Out-of-Box Experience (OOBE) options appropriate for your unit.
  5. Assign the deployment profile to the dynamic device group created earlier.

Step 5: Assign Required Intune Policies and Applications

Assign the configuration profiles, compliance policies, security policies, applications, and other Microsoft Intune resources required by your unit to the appropriate device or user groups.

Unlike Microsoft Entra hybrid joined Autopilot devices, Microsoft Entra joined devices do not require a Domain Join configuration profile, an Active Directory Organizational Unit (OU), or an OU Distinguished Name (DN).

Step 6: Provision the Device

Start or reset the registered Windows device and connect it to the Internet.

During the Windows Out-of-Box Experience (OOBE), Windows Autopilot identifies the registered device and applies its assigned deployment profile.

The user signs in with their UIC credentials. The device then joins Microsoft Entra ID, enrolls in Microsoft Intune, and receives the policies and applications assigned to the device or user.

Print Article