Month 2: Out of the box, into the business

What Windows Autopilot does

Windows Autopilot takes the OEM's preinstalled Windows and makes it business-ready during setup (OOBE): it joins Microsoft Entra ID, enrolls in Intune, applies policies and installs apps. You don't build or maintain images. Kibble gets two flavors: classic Windows Autopilot with deployment profiles, and the newer Windows Autopilot device preparation.

Classic Autopilot: deployment profiles

Devices are registered first: the vendor or reseller uploads the hardware hash, or you import a CSV. A deployment profile assigned to a device group sets the mode, join type (Entra or hybrid), OOBE screens, user account type and device name template. Progress shows on the Enrollment Status Page (ESP). It supports user-driven, pre-provisioning, self-deploying and existing-device scenarios.

Exam tip Registered devices often get grouped by the Autopilot group tag, which you met as [OrderID] in week 1.

Autopilot device preparation

Device preparation needs no hardware hash upload. A policy is assigned to a user group. When a user signs in at OOBE, the device lands in a chosen device security group at enrollment time (enrollment time grouping; the group's owner must be the Intune Provisioning Client). It installs only selected essential apps (up to 25) and scripts (up to 10), shows its own progress screen instead of the ESP, and reports in near real time. Entra join and Windows 11 only.

Exam tip A device registered for classic Autopilot gets the Autopilot profile; it takes precedence. To use device preparation on it, deregister it first.

Choosing between them

Pick classic Autopilot when you need pre-provisioning, self-deploying mode, hybrid join, Autopilot Reset, HoloLens or Teams Rooms devices, or a long app list during setup. Pick device preparation when you want simple setup without registering hashes, need LOB and Win32 apps together reliably, or work in GCC High or DoD.

Need                         Use
Kiosk PC, no user            Autopilot
Hybrid join to the domain    Autopilot
No hash upload, quick setup  Device prep
Win32 + LOB apps in setup    Device prep

Three deployment modes

User-driven: the user signs in at OOBE; the device joins Entra (or hybrid joins) and installs everything for them. Pre-provisioning: a technician or partner presses the Windows key five times at the first OOBE screen and runs the device phase ahead of time; the user later finishes only the user part. Self-deploying: no user credentials at all, for kiosks, shared devices and meeting rooms. Entra join only, and it needs TPM 2.0 attestation.

Exam tip "Device with no user" = self-deploying. "IT preps it, user finishes fast" = pre-provisioning. Both need a TPM 2.0 that supports attestation.

Device name templates

In an Autopilot profile, Apply device name template renames Entra joined devices during setup. Rules: up to 15 characters; letters, numbers and hyphens; not only numbers; no spaces. %SERIAL% adds the serial number, and %RAND:x% adds x random digits. Hybrid joined devices use the computer name prefix in the Domain Join profile instead, which doesn't support these macros.

KC-%SERIAL%  -> KC-5CG4120QXZ
KC-%RAND:6%  -> KC-482915
KCST-%RAND:4%-> KCST-0371

Exam tip Macros are case-sensitive: %serial% fails. Long serials get cut to stay within 15 characters.

What the ESP shows and blocks

The Enrollment Status Page shows setup progress during OOBE in two phases: device setup (device policies, certificates, device apps) and account setup (user policies and apps after first sign-in). With Block device use until all apps and profiles are installed, users can't reach the desktop before the device is ready. The built-in default profile shows no progress, so create your own.

Setting up your device for work
Device preparation   Complete
Device setup         Working...
  Security policies  2 of 3
  Apps               1 of 4
Account setup        Waiting

Key ESP settings

Under Devices > Enrollment > Windows > Enrollment Status Page: Show app and profile configuration progress (Yes turns it on); Show an error when installation takes longer than (default 60 minutes); custom error message; log collection and diagnostics page; Block device use until these required apps are installed: All or Selected (up to 100 apps); and whether users may reset or continue anyway after an error.

Exam tip Profiles have priority. Device-targeted beats user-targeted, and the default profile applies only when nothing else does. Pre-provisioning and self-deploying only see device-targeted profiles.

Keeping the ESP fast and reliable

Block only on essential apps (security agent, VPN, line-of-business core) and let the rest install afterward. During classic Autopilot, don't mix LOB (MSI) apps and Win32 apps: both need the Trusted Installer service and can collide. Package everything as Win32. Turn on log collection so failed devices can export logs.

Exam tip Device preparation installs apps one after another, so mixing LOB and Win32 is fine there. In classic Autopilot with the ESP, it's the classic trap.

Upgrading to Windows 11 with Intune

Check readiness first: Intune's Windows feature update device readiness report flags devices that miss hardware requirements (TPM 2.0, CPU, Secure Boot) or have known app risks. Then create a feature update policy under Devices > Windows updates and pick the target version, for example Windows 11, version 26H2. Devices move to that version and stay there until you change the policy.

Exam tip Windows 10 reached end of support on October 14, 2025. If a device also has an update ring, set its feature update deferral to 0 so it doesn't delay the feature update policy.

Windows 365 Cloud PCs

A Cloud PC is a Windows desktop hosted by Microsoft. A provisioning policy decides how Cloud PCs are created: join type and network (Entra join with the Microsoft-hosted network is recommended; hybrid join needs an Azure network connection, ANC), image (a gallery image, or a custom image you upload), region, single sign-on, and the user groups to assign. Licensed users in those groups get a Cloud PC automatically.

Exam tip Editing a provisioning policy doesn't change existing Cloud PCs. Only new or reprovisioned ones get the new settings.

Windows Backup for Organizations

Users can back up Windows settings to the cloud and restore them on a new or reset Entra joined PC during OOBE. Two parts: a settings catalog policy with Enable Windows Backup (Sync your settings), and the tenant-wide Windows Backup and Restore option under Devices > Enrollment > Windows, with Show restore page set to On.

Exam tip Restore works at OOBE on Entra joined devices in user-driven setups. Not with self-deploying mode, hybrid join or the pre-provisioning technician flow.