1.2MD-102Advanced
Est: ~15 mins•Verified: 2026-08

Windows Autopilot: Self-Deploying Mode & Kiosks

Deploy shared PCs, digital signage, and dedicated kiosk devices without user interaction using TPM 2.0 device attestation and Microsoft Intune.

Tags:#Autopilot#Self-Deploying#Kiosk#TPM 2.0#Intune#MD-102
01

Overview

Windows Autopilot Self-Deploying mode deploys Windows 10/11 devices with zero user interaction. Unlike User-Driven mode, no user credentials or sign-in are required during the Out-of-Box Experience (OOBE).

Instead, the device proves its identity to Microsoft Entra ID using TPM 2.0 cryptographic device attestation, joins Microsoft Entra ID, enrolls into Intune, and deploys assigned kiosk configurations and apps automatically.

---

02

When to Use

ScenarioRecommendationTechnical Rationale
Kiosks & Digital SignageHighly RecommendedSingle-app or multi-app kiosks running unattended in retail or public environments.
Shared Shift-Worker PCsRecommendedFactory floor or hospital stations shared across multiple rotational workers.
Personal Standard WorkstationsDo Not UseSelf-deploying does not assign primary user affinity; use User-Driven mode instead.

---

03

Prerequisites

  • Physical TPM 2.0 Chip: Must support EK (Endorsement Key) attestation. Virtual TPMs (Hyper-V) are not supported unless TPM attestation is specifically configured.
  • Wired Ethernet or Public Wi-Fi: Must connect without interactive Captive Portal authentication.
  • Entra ID License: Microsoft Entra ID P1 or P2 license assigned to tenant.

---

04

Portal Path

TEXT
Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Windows
        └── Windows enrollment
            └── Deployment Profiles
                └── Create Profile (Windows PC)
                    └── Deployment Mode: Self-Deploying

---

05

Step-by-Step Implementation

  1. Create Profile: Navigate to Deployment Profiles > Create Profile > Windows PC.
  2. Configure Settings:
  • Deployment mode: Self-Deploying (preview)
  • Join to Microsoft Entra ID as: Microsoft Entra joined
  • User account type: Standard
  • Language / Region: Set your target locale (e.g., English (United States))
  • Automatically configure keyboard: Yes
  1. Assign: Assign to a dedicated dynamic device group (e.g., Sec-Devices-Kiosks-Autopilot).

---

06

PowerShell Commands

Check TPM 2.0 Readiness & Attestation Support:

PowerShell
# Verify TPM 2.0 chip presence, ready status, and EK certificate
Get-Tpm | Select-Object TpmPresent, TpmReady, ManufacturerId, ManufacturerVersion

# Check if TPM supports attestation (Required for Self-Deploying mode)
(Get-Tpm).ManufacturerVersionFull20

---

10

Troubleshooting Matrix

Error CodeRoot CauseResolution
0x800705b4 (TPM Attestation Timeout)The device TPM chip failed to contact AMD/Intel/Infineon attestation endpoints within timeout limit.1. Ensure outbound access to OEM TPM attestation servers.
2. Update motherboard BIOS/UEFI firmware to latest version.
0x80180014 (Enrollment Blocked)Enrollment restrictions block Windows personal devices or MDM user scope.Ensure Intune Device Type Restrictions allow Windows MDM enrollment.

---

12

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

Key Exam Takeaways:

  1. Self-Deploying mode does not prompt for user credentials at any point during OOBE.
  2. Requires a physical TPM 2.0 chip capable of cryptographic attestation.
  3. Does not assign a Primary User in Microsoft Intune upon completion.
PREVIOUS TOPIC1.1 Windows Autopilot: User-Driven Entra JoinNEXT TOPIC1.3 Enrollment Device Platform Restrictions & MDM Scope