1.1MD-102Intermediate
Est: ~15 mins•Verified: 2026-08

Windows Autopilot: User-Driven Entra Join

Zero-touch Out-of-Box Experience (OOBE) provisioning guide for enrolling Windows 10 & 11 devices directly into Microsoft Entra ID and Microsoft Intune.

Tags:#Autopilot#Entra ID#Intune#OOBE#Hardware Hash#MD-102
01

Overview

Windows Autopilot User-Driven mode for Microsoft Entra ID enables zero-touch IT provisioning where end-users unbox a new OEM device, power it on, connect to Wi-Fi/Ethernet, and enter their corporate Microsoft 365 credentials.

During the Out-of-Box Experience (OOBE), the device automatically:

  1. Contacts the Microsoft Autopilot Deployment Service using its 4K Hardware Hash.
  2. Downloads the organization's customized Autopilot Deployment Profile and displays tenant branding.
  3. Automatically joins Microsoft Entra ID (cloud-native, no on-premises Active Directory line-of-sight required).
  4. Auto-enrolls into Microsoft Intune MDM.
  5. Runs the Enrollment Status Page (ESP) to enforce baseline security configurations, certificates, and core Win32 applications before granting desktop access.

---

02

When to Use

ScenarioRecommendationTechnical Rationale
New OEM PCs (Remote / Hybrid Workers)Highly RecommendedLaptops ship directly from vendor (Dell/HP/Lenovo) to user home without IT pre-staging.
Corporate Windows Devices (Wipe & Reload)RecommendedAfter an Intune Wipe or Fresh Start, the device re-provisions seamlessly through Autopilot.
Shared / Kiosk PCs (No User Login)Use Self-Deploying ModeUser-Driven requires end-user credentials; kiosks require TPM 2.0 Self-Deploying mode.
Hybrid Entra Joined (Require On-Prem AD)Use Hybrid User-DrivenRequires Intune Connector for Active Directory and line-of-sight/VPN to Domain Controllers during OOBE.

---

03

Prerequisites

Tenant & Licensing Requirements:

  • Intune License: Microsoft 365 E3/E5, Microsoft 365 Business Premium, or Enterprise Mobility + Security (EMS E3/E5).
  • Microsoft Entra ID P1 / P2: Required for MDM auto-enrollment and Conditional Access integration.
  • MDM User Scope Configured: Navigate to Entra Admin Center > Mobility (MDM and WIP) > Microsoft Intune > Set MDM user scope to All or a target security group.
  • Company Branding Configured: Configured in Entra ID to show custom logos and banners during OOBE login.

Endpoint & Hardware Requirements:

  • Windows 11 Pro/Enterprise (22H2+) or Windows 10 Pro/Enterprise.
  • TPM 2.0 enabled in BIOS/UEFI.
  • Unrestricted outbound access on ports 80 / 443 to:
  • *.manage.microsoft.com
  • ztd.events.data.microsoft.com
  • login.microsoftonline.com

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Windows
        └── Windows enrollment
            ├── Devices (Under Windows Autopilot)
            ├── Deployment Profiles
            └── Enrollment Status Page (ESP)

---

05

Step-by-Step Implementation

Step 1: Create a Dynamic Entra ID Device Group

Create a dynamic group targeting all Autopilot devices tagged with a specific Group Tag (OrderID):

  1. Navigate to Intune Admin Center > Groups > All groups > New group.
  2. Group type: Security | Membership type: Dynamic Device.
  3. Configure the dynamic query syntax:
TEXT
(device.devicePhysicalIDs -any (_ -eq "[OrderID]:CorpWin11"))

Step 2: Configure the Autopilot Deployment Profile

  1. Navigate to Devices > Windows > Windows enrollment > Deployment Profiles > Create Profile > Windows PC.
  2. Configure settings:
  • Deployment mode: User-Driven
  • Join to Microsoft Entra ID as: Microsoft Entra joined
  • Microsoft Software License Terms: Hide
  • Privacy settings: Hide
  • User account type: Standard (Recommended: Least privilege)
  • Apply device name template: Yes > Template: CORP-%SERIAL%
  1. Assignments: Assign to group Sec-Devices-Autopilot-Corporate-Win11.

Step 3: Configure Enrollment Status Page (ESP)

  1. Go to Windows enrollment > Enrollment Status Page > Edit Default profile.
  2. Set Show app and profile configuration progress: Yes.
  3. Set Block device use until all apps and profiles are installed: Yes.
  4. Select critical blocking apps (Defender, Company Portal, VPN client).

---

06

PowerShell Automation

Harvest Hardware Hash Locally at OOBE Screen (Shift + F10):

PowerShell
# Run in elevated Command Prompt / PowerShell at OOBE (Press Shift + F10)
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force

# Install official Autopilot harvesting script from PSGallery
Install-Script -Name Get-WindowsAutoPilotInfo -Force

# Export Hardware Hash to CSV with specified GroupTag
Get-WindowsAutoPilotInfo.ps1 -OutputFile C:\HWID.csv -GroupTag "CorpWin11"

Direct Online Upload from Endpoint to Intune Tenant:

PowerShell
# Directly uploads the hardware hash to tenant without using USB flash drives
Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force
Install-Script -Name Get-WindowsAutoPilotInfo -Force
Get-WindowsAutoPilotInfo.ps1 -Online -GroupTag "CorpWin11" -Assign

---

07

Microsoft Graph Automation

Query Registered Autopilot Devices via Microsoft Graph PowerShell SDK:

PowerShell
# Connect to Microsoft Graph with required administrative permissions
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"

# Query Autopilot devices and their enrollment profile status
Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -All | 
    Select-Object id, serialNumber, model, manufacturer, groupTag, enrollmentState | 
    Format-Table -AutoSize

---

08

Verification Checklist

VERIFICATION CHECKLIST
0/5 (0%)
Autopilot profile status shows Assigned in Intune Admin Center (Devices > Windows enrollment > Devices).
Run dsregcmd /status on endpoint: Verify AzureAdJoined : YES and MdmEnroll : YES.
Verify device hostname adheres to the template (e.g., CORP-<SERIAL>).
Verify the signed-in user is a Standard User (not in local Administrators group).
Verify device status in Intune shows Compliant and BitLocker keys are escrowed to Entra ID.
09

Diagnostic Logs & Channels

Channel / ToolLog LocationPurpose
MDM Diagnostics Toolmdmdiagnosticstool.exe -area Autopilot;DeviceEnrollment -cab C:\Logs.cabGathers all MDM, Autopilot, and enrollment logs into a single CAB file.
Intune Management Extension (IME)C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.logEssential for troubleshooting Win32 app deployments, detection rules, and scripts.
Event Viewer: AutopilotApplications and Services Logs > Microsoft > Windows > ModernDeployment-Diagnostics-Provider > AutopilotRecords OOBE policy download, profile assignment, and stage transitions.
Registry Policy PathHKLM\SOFTWARE\Microsoft\Provisioning\AutopilotPolicyInspects downloaded Autopilot policy settings and tenant registration flags.

---

10

Troubleshooting Matrix

Error Code / SymptomRoot CauseExact Resolution
0x80180014
(Device not supported)		MDM User Scope is not targeted to the user, or Intune Enrollment Device Platform Restrictions block Windows (MDM).1. Go to Intune > Devices > Enrollment device platform restrictions.
2. Allow Windows (MDM).
3. Verify user has active Intune license in Entra ID.
0x800705b4
(ESP Timeout / App failure)		An application set as "Blocking" in the Enrollment Status Page failed to install or timed out (default 60 mins).1. Review IntuneManagementExtension.log for failing App GUID.
2. Change app install context from User to System or remove from ESP blocking list.
80180005
(Device limit exceeded)		The user has reached the maximum number of registered devices in Entra ID (default is 50 devices).Go to Entra Admin Center > Devices > Device Settings > Increase Maximum number of devices per user or delete stale devices.
Generic OOBE Login Screen
(ZTDID mismatch)		Device hardware hash was not imported, or the Autopilot Profile is still in Assigning status.Ensure profile status column shows Assigned. Press Shift+F10 and run Get-WindowsAutoPilotInfo.ps1 -Online -GroupTag CorpWin11 -Assign.

---

11

Production Best Practices

Production Best Practice

OEM Reseller Direct Pre-Registration:

In enterprise production, never manually harvest CSV files with a USB drive. Require your OEM hardware reseller (Dell, Lenovo, HP, Insight) to register devices directly into your tenant using your Microsoft Cloud Solution Provider (CSP) partner relationship.

Security Caution

Autopilot Device Retirement Order:

When retiring or re-purposing an Autopilot PC, you MUST delete records in this exact 3-step sequence:

  1. Delete Intune MDM record (Intune > Devices > Windows > Delete).
  2. Delete Windows Autopilot Device identity (Intune > Windows enrollment > Devices > Delete).
  3. Delete Microsoft Entra ID Device record (Entra ID > Devices).

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

  1. Dynamic Group Rule Syntax: In the Intune GUI, the property is called Group Tag, but in dynamic queries you must write [OrderID]:

device.devicePhysicalIDs -any (_ -eq "[OrderID]:CorpWin11")

  1. Self-Deploying Mode vs User-Driven: Self-deploying requires a physical TPM 2.0 chip with device attestation and zero user interaction (ideal for Kiosks). User-Driven requires end-user credentials.
  2. Convert targeted devices to Autopilot: Automatically captures hardware hashes of existing enrolled Windows devices. It does not convert unmanaged BYOD devices until enrolled.

---

13

Official Documentation

NEXT TOPIC1.2 Windows Autopilot: Self-Deploying Mode & Kiosks