Windows Autopilot explained: a new laptop ready without an IT visit

Windows Autopilot is a Microsoft service that lets a new Windows laptop set itself up for your business. Your employee unboxes the laptop, connects to the internet and signs in with their work account. The laptop then joins your organisation in Microsoft Entra ID, enrols in Microsoft Intune and picks up the apps, settings and security that are ready for that employee. Nobody from IT needs to touch the laptop.

This article is about Windows Autopilot for deploying Windows devices, not about other products that are also called Autopilot. You will read how it works, which modes there are, what you need and where it goes wrong.

What exactly is Windows Autopilot?

IT used to set up a laptop with an image: a copy of Windows with all the software included, which you had to maintain for each model. The laptop first came to the office, was wiped and reinstalled.

Autopilot uses the Windows installation the manufacturer has already put on the laptop and makes it business-ready. During the first start-up it applies your settings and policies, installs apps and can change the edition, for example from Windows Pro to Enterprise. So you no longer need to maintain images and drivers for each model.

How does Windows Autopilot work, step by step?

1. The laptop is registered

Every laptop has a unique hardware identity, the hardware hash, which includes the manufacturer, model and serial number. The Autopilot service must know this identity and link it to your organisation. Only then does the laptop know where it belongs when it first starts.

Ideally your supplier or IT partner does this registration at the time of purchase, using details from the packaging or the manufacturer. An administrator in your organisation gives the partner permission to do so.

You can also register a laptop yourself: you read out the hardware hash and upload it to Intune. The laptop does have to boot into Windows first for that. Laptops that are already in Intune as corporate devices can be converted to Autopilot automatically.

2. You assign a deployment profile

In the deployment profile in Intune you define how the first start-up goes: which mode, which language and keyboard, whether the licence and privacy screens are skipped, whether the employee becomes a local administrator or a standard user, and which naming template the laptop gets. You assign the profile to a group of devices.

3. The employee signs in with their work account

The employee switches the laptop on, connects to the internet and sees a sign-in screen with your organisation's name and logo. They sign in with their business email address and password, plus MFA where required. The laptop joins Entra ID and enrols in Intune automatically. Whoever signs in here becomes the primary user in Intune.

4. Intune delivers, the Enrollment Status Page keeps track

Intune now sends the apps, security settings, Wi-Fi profiles and certificates assigned to the laptop and the user. The Enrollment Status Page (ESP) shows the progress, first for the device and then for the account.

You can make the ESP wait until the most important apps are installed, so that nobody starts on a half-configured laptop. You also decide after how many minutes the ESP shows an error (60 by default) and which text goes with it, for example your helpdesk number.

Which Windows Autopilot modes are there?

Autopilot has three modes. Since 3 June 2024 there has also been a newer variant: Windows Autopilot device preparation.

User-driven is the standard for most SMBs.

Self-deploying works without a user account and requires a TPM 2.0 chip. No primary user is set on the device, so it suits shared devices.

Pre-provisioning splits the work. A technician or your IT partner presses the Windows key five times on the first screen and has the device part installed in advance. The employee then only goes through the account part. This also requires TPM 2.0.

Windows Autopilot device preparation needs no prior registration. The policy is linked to a group of users, and the laptop is placed straight into a fixed device group during enrolment. During setup it installs a limited list of essential apps and scripts, and a report shows in near real time how each deployment is going. The limits: Windows 11 only, Entra join only, and no pre-provisioning, self-deploying or Autopilot Reset. Each laptop always runs only one of the two variants.

What do you need for Windows Autopilot?

• Microsoft Entra ID with automatic enrolment in Intune, which requires Entra ID P1 or P2.
• Microsoft Intune, or another MDM service that works with Autopilot.
• A suitable licence per user, such as Microsoft 365 Business Premium, E3, E5, F1 or F3, or Entra ID P1 with a separate Intune subscription. Business Basic and Business Standard do not include Entra ID P1 or Intune. You can find current prices at Microsoft 365 licences and prices.
• Windows 11 Pro, Enterprise or Education. Windows Home is not on Microsoft's list.
• Users who are allowed to join devices to Entra ID, for the user-driven mode.
• Internet, with access to the Microsoft services Autopilot uses.

Make sure the licence is actually assigned: according to Microsoft, the ESP gets stuck without an Intune licence. And Microsoft advises joining new laptops to Entra ID only, no longer also to an on-premises Active Directory domain.

What does Windows Autopilot offer an SMB?

A new employee gets their laptop straight from the supplier, even at home. On their first working day they sign in and everything is ready.

A broken or stolen laptop is quick to replace. The employee signs in on the new laptop and gets the same setup. If their files are in OneDrive or SharePoint, they carry on as soon as those have synchronised.

Reusing a laptop is done with Autopilot Reset, which you start remotely from Intune. Personal files, apps and settings are removed, while the connection with Entra ID and Intune stays. The next user signs in and becomes the new primary user.

No more images. A new laptop model does not mean a new image.

Standard user from the start. Nobody starts on a laptop where they can install anything they like.

Where does it go wrong? The most common pitfalls

The laptop is not registered. Autopilot does not know a laptop that was bought in a hurry from a shop. Windows then starts the normal setup, without your settings. Agree with your supplier that they register every laptop, and check before unboxing that the device is in Intune with a profile.

Someone else signs in first. Whoever signs in at the first start-up becomes the primary user. So do not "quickly prepare" the laptop with someone else's account or a shared account. If that has happened, reset it.

No or limited internet. Without a connection the laptop cannot download its profile. Wi-Fi with a sign-in page, as in a hotel, or a strict firewall needs extra configuration.

Apps that take a long time. The more and the larger the apps that have to install during the ESP, the longer the employee waits, until the time limit triggers an error. Only let the ESP wait for the apps that are really needed to get started. Microsoft also warns against combining MSI packages and Win32 apps, because the installations block each other.

A new motherboard. After such a repair Autopilot no longer recognises the laptop, and it has to be registered again.

How does Autopilot fit with Intune?

Autopilot handles the start: linking the laptop to your organisation and enrolling it. Intune does everything after that: delivering apps, keeping updates and security up to date, switching on BitLocker and Defender, and checking whether a laptop meets your requirements. You can read more in what is Microsoft Intune.

So Autopilot is only as good as your setup in Intune. Without apps and policies ready, it delivers an empty laptop. Most of the work is in the preparation: which apps does everyone get, which settings apply and who is allowed to do what.

Together they cover the whole life cycle: Autopilot at the start, Intune during use, Autopilot Reset for a new user. When a laptop leaves the organisation for good, remove it from Intune and from Autopilot.

How we do it

At Virtual Computing, Autopilot is part of our Intune device management. We work with a user-driven profile in which the employee is a standard user, an Enrollment Status Page that waits until the most important apps are installed, and an error message that points to our support team. We convert laptops that are already in Intune to Autopilot, and a personal PC cannot accidentally enrol in your company. Managing your own laptops and PCs through Intune costs from €10 per device per month with us. How that fits into your whole workplace is explained at Modern Workplace and workplace management.