1.4MD-102Advanced

Est: ~15 mins•Verified: 2026-08

Windows Autopilot: Pre-Provisioned Deployment

Technician-driven staging and device pre-provisioning workflow (formerly White Glove) for pre-installing apps, certificates, and policies before shipping to end users.

Tags:#Autopilot#Pre-Provisioning#White Glove#TPM 2.0#Intune#MD-102

Overview

Windows Autopilot Pre-Provisioned Deployment (formerly referred to as White Glove) splits the provisioning process into two distinct phases:

Technician Phase: IT staff, an OEM partner, or a staging facility boots the PC into OOBE, presses the Windows key 5 times, connects to a high-speed wired/Wi-Fi network, and pre-installs all targeted device-context applications, language packs, certificates, and compliance policies. Once complete, the device is sealed (Reseal).
User Phase: When the end-user receives the device at home or in an office branch, they unbox it, connect to their local network, authenticate with corporate Entra credentials, and complete a significantly shorter, lightweight user-targeted ESP phase.

This drastically eliminates user wait times for multi-gigabyte software installs (such as Microsoft 365 Apps, CAD tools, or developer environments).

---

When to Use

Scenario	Recommendation	Technical Rationale
Heavy Enterprise App Baselines (> 15 GB)	Highly Recommended	Prevents home broadband download bottlenecks and user ESP timeouts.
Global Branch Offices (No Local IT)	Highly Recommended	Central staging hub or OEM pre-provisions and seals laptops before dispatching globally.
Shared / Dedicated Kiosks	Use Self-Deploying Mode	Self-deploying requires zero user authentication; pre-provisioning is built for assigned users.
Virtual Machines (Lab / Testing)	Conditional	Requires Hyper-V Gen 2 with vTPM enabled; physical TPM 2.0 attestation is strictly validated.

---

Prerequisites

Tenant & Licensing Requirements:

Intune License: Microsoft 365 E3/E5, Business Premium, or EMS E3/E5.
Microsoft Entra ID P1 / P2: For MDM auto-enrollment and device registration.
Autopilot Profile Configured: "Allow pre-provisioned deployment" enabled in the profile.

Endpoint & Hardware Requirements:

Windows 11 Pro/Enterprise (22H2+) or Windows 10 Pro/Enterprise (20H2+).
Physical TPM 2.0 Chip: Must support EK (Endorsement Key) hardware attestation with Infineon, STMicroelectronics, or Nuvoton chips.
Wired Ethernet Preferred: Wi-Fi is supported on Windows 11 but wired connection prevents 802.1x/certificate chicken-and-egg issues during technician flow.

---

Portal Path

TEXT

Microsoft Intune Admin Center (https://intune.microsoft.com)
└── Devices
    └── Windows
        └── Windows enrollment
            └── Deployment Profiles
                └── [Target Autopilot Profile]
                    └── Properties > Out-of-box experience (OOBE)
                        └── Allow pre-provisioned deployment: Yes

---

Step-by-Step Implementation

Step 1: Enable Pre-Provisioning in the Autopilot Profile

Navigate to Intune Admin Center > Devices > Windows > Windows enrollment > Deployment Profiles.
Select your corporate User-Driven Autopilot profile or click Create Profile > Windows PC.
Under Out-of-box experience (OOBE) settings:

Deployment mode: User-Driven
Join to Microsoft Entra ID as: Microsoft Entra joined
Allow pre-provisioned deployment: Set to Yes

Assign the profile to the device security group.

Step 2: Configure Enrollment Status Page (ESP)

Go to Windows enrollment > Enrollment Status Page > Default.
Configure Block device use until all apps and profiles are installed: Yes.
Under Block device use until these required apps are installed, select all device-context Win32 and LOB apps.

Step 3: Execute the Technician Flow on the Endpoint

Power on the new device into the OOBE initial language/region selection screen.
Press the Windows key 5 times in rapid succession.
The Autopilot companion provisioning dialog appears. Select Windows Autopilot provisioning > Click Continue.
The screen displays the assigned organization name, Autopilot profile name, and assigned user (if pre-assigned). Click Provision.
The device contacts the Autopilot service, joins Entra ID with a temporary device token, downloads device-assigned policies, certificates, and Win32 apps.
When complete, a Green Status Screen appears displaying provisioning elapsed time.
Click Reseal to shut down the PC. Box and ship the device to the end user.

---

PowerShell Automation

Force Hardware Attestation Diagnostic Check (OOBE Shift + F10):

PowerShell

# Verify TPM 2.0 chip presence, readiness, and Endorsement Key status
Get-Tpm | Select-Object TpmPresent, TpmReady, TpmEnabled, ManufacturerVersion, AutoProvisioning

# Test TPM device attestation endpoints connectivity
Test-NetConnection -ComputerName "attest.azure.net" -Port 443
Test-NetConnection -ComputerName "ztd.events.data.microsoft.com" -Port 443

Inspect Pre-Provisioning QR Code / Diagnostic Output:

PowerShell

# Export diagnostic logs generated during technician provisioning
mdmdiagnosticstool.exe -area Autopilot;TPM -cab C:\PreProvisioning_Logs.cab

---

Microsoft Graph Automation

Enable Pre-Provisioning Flag via Microsoft Graph PowerShell:

PowerShell

Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"

# Retrieve existing Windows Autopilot deployment profile
$Profile = Get-MgDeviceManagementWindowsAutopilotDeploymentProfile -Filter "displayName eq 'Corp-Win11-UserDriven'"

# Update profile to enable pre-provisioned deployment (preProvisioningAllowed = true)
$Params = @{
    "@odata.type" = "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile"
    preProvisioningAllowed = $true
}

Update-MgDeviceManagementWindowsAutopilotDeploymentProfile `
    -WindowsAutopilotDeploymentProfileId $Profile.Id `
    -BodyParameter $Params

---

Verification Checklist

VERIFICATION CHECKLIST

0/6 (0%)

"Allow pre-provisioned deployment" is toggled to Yes in the target Autopilot Profile.

Endpoint BIOS shows TPM 2.0 is enabled, active, and owned with valid EK certificate.

Pressing Windows key 5 times at OOBE successfully launches the provisioning selection dialog.

Technician phase ends with a Green Screen indicating all device apps and policies installed.

Clicking Reseal properly powers off the machine without leaving active technician sessions.

End-user boot prompts for corporate username/password and takes less than 5 minutes to land on desktop.

Diagnostic Logs & Channels

Channel / Tool	Log Location	Purpose
Autopilot Technician Event Log	`Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot`	Tracks technician phase start, TPM attestation, and reseal events.
TPM Attestation Event Log	`Microsoft-Windows-TPM-WMI`	Logs Endorsement Key (EK) validation errors and certificate authority failures.
Intune Management Extension	`C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\AgentExecutor.log`	Verifies device-context PowerShell scripts executed during technician phase.

---

Troubleshooting Matrix

Error Code / Symptom	Root Cause	Exact Resolution
Red Screen: `0x80180018` (Securing your hardware failed)	TPM 2.0 Attestation failure. The device TPM manufacturer EK certificate is not recognized by Azure Attestation.	1. Update machine BIOS to latest firmware. 2. Clear TPM in BIOS/tpm.msc and reboot. 3. Verify machine clock is UTC synchronized.
Windows key x5 does nothing	The language/region screen has not fully initialized, or the Autopilot profile is not assigned.	Wait 30 seconds after OOBE boot. Ensure the device serial is assigned to a profile in Intune.
Yellow Screen at Technician End	One or more non-blocking apps or policies failed to apply, but process continued.	Check `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log` to identify failed app.
User phase asks for domain join	Profile is configured as Hybrid Entra Joined without line-of-sight to Domain Controller.	Pre-provisioning for Hybrid Entra Join requires active VPN/LAN connection to on-prem domain controllers.

---

Production Best Practices

Production Best Practice

Use Device Context for Pre-Provisioned Apps:

Any app intended to install during the Technician phase MUST be targeted in Device context (System). Apps configured with User context will defer until the end user logs in during the User phase.

Security Caution

Do Not Run Windows Updates During Technician Flow:

Avoid triggering cumulative OS updates or firmware updates via scripts during the technician phase, as unexpected reboot cycles can break the Autopilot state engine and trigger a Red Screen.

---

MD-102 Exam Notes

Exam Blueprint & High-Yield Traps

High-Frequency Exam Objectives & Traps:

Technician Shortcut: Memorize the shortcut to invoke pre-provisioning: press the Windows key 5 times at the first OOBE screen.
TPM Requirement: Pre-provisioned deployment requires physical TPM 2.0 with device attestation. It does NOT support TPM 1.2.
Reseal Action: The technician must click Reseal to prepare the device for end-user handover; manually shutting down the PC via the power button can corrupt the seal state.

---

Official Documentation

PREVIOUS TOPIC1.3 Enrollment Device Platform Restrictions & MDM Scope NEXT TOPIC1.5 Mobile Enrollment: Apple ADE & Android Enterprise