Implementing Windows Autopilot

Windows Autopilot is a collection of technologies built into Windows and Microsoft cloud services that automates the process of preparing a new device for a user. It fundamentally changes the old way of doing things.

Traditionally, setting up a new Windows computer for an employee involved a process called 'imaging'. An IT professional would take a bare-metal device (a brand-new, unconfigured laptop), boot it from a USB drive or network server, and install a pre-made 'golden image' — a snapshot of Windows that included all the company's required software, settings, and security policies. This imaging process could take anywhere from 30 minutes to several hours per device, and it required the IT team to physically touch every single machine. If the company had 100 new laptops arriving, that was 100 hours of manual work.

Windows Autopilot eliminates imaging entirely. Here is how it works, step by step.

First, a hardware vendor (like Dell, HP, or Lenovo) or a reseller 'registers' each new device with Microsoft's cloud service. They do this by uploading the device's unique hardware hash — a cryptographic fingerprint made up of identifiers from the device's motherboard, network card, and other components — to the Microsoft Partner Center. This registration happens before the device ever leaves the factory. When the company purchases the device, the IT administrator can then claim that device into their own organisation's Microsoft Entra ID tenant (their dedicated cloud directory) using the Microsoft Endpoint Manager admin centre (formerly Intune).

Once the device is claimed, the IT administrator assigns an 'Autopilot deployment profile' to that device or to a dynamic group containing the device. This profile is a set of instructions that tells the device exactly how to behave during its first boot, called the 'out-of-box experience' (OOBE). For example, the profile can specify whether the user should see a corporate-branded login screen, whether the device should join Microsoft Entra ID automatically, whether to skip the privacy settings prompts, and which standard apps (like Microsoft 365) to install silently in the background.

When the employee unboxes the laptop and turns it on, the device does not show the usual Windows setup wizard that asks for a personal Microsoft account. Instead, the device connects to the internet (via Wi-Fi or Ethernet), and it automatically contacts the Windows Autopilot cloud service. The cloud service checks the device's hardware hash against the registered devices in the organisation's tenant. If it finds a match, it sends down the deployment profile. The device then configures itself according to that profile.

The key technical components involved are:

Why did Microsoft create Autopilot? The old imaging model had several problems. Images became outdated quickly (drivers changed, security patches were released). Every device required a unique driver pack, which meant the IT team had to maintain dozens of different images for different hardware models. Imaging also required complex infrastructure like Windows Deployment Services (WDS) and System Center Configuration Manager (SCCM), which were expensive and hard to manage. Autopilot relies on the cloud, so there is no on-premises infrastructure to maintain. The device configures itself based on its specific hardware ID, so it always gets the correct drivers directly from Windows Update.

Autopilot also supports different deployment scenarios. 'User-Driven Mode' is for standard laptops: the employee signs in with their work email, and the device joins the domain automatically. 'Self-Deploying Mode' is for shared devices or kiosks: the device boots directly to a restricted desktop without any user login. 'White Glove' (also called 'pre-provisioning') allows an IT technician to perform the initial setup steps on behalf of the end user, so the user only has to sign in when they receive the device.

For the exam, you must remember that Autopilot is entirely cloud-based. There is no requirement for on-premises Active Directory, VPNs, or imaging servers. However, the device does need internet connectivity on first boot — without it, Autopilot cannot contact the cloud service and will fall back to the traditional OOBE.

An IT professional's day involves a lot of manual tasks, but Autopilot frees up their time. Here is a concrete scenario.

Sarah is the IT administrator for a mid-sized company called Contoso Corp. The company has just purchased 50 new Dell Latitude laptops from a reseller. Without Autopilot, Sarah would have to unbox all 50 laptops, boot each one from a USB drive containing a Windows 11 image, wait 45 minutes per device for the installation, install drivers for that specific model (which might require downloading them manually), join each device to the company's on-premises Active Directory, install Microsoft 365 Apps (Word, Excel, Outlook) from a network share, apply security policies via Group Policy, and then hand the laptop to the employee — who would still have to set up their own profile and password. This would take Sarah at least 40 hours of work.

With Autopilot, Sarah's workflow is completely different.

First, Sarah asks the reseller to register all 50 devices with Microsoft's Partner Center. The reseller provides Sarah with a CSV file containing the serial numbers and hardware hashes of the laptops. Sarah opens the Microsoft Endpoint Manager admin centre (https://devicemanagement.microsoft.com), goes to 'Devices > Enroll Devices > Windows registration', and clicks 'Import'. She uploads the CSV file. This imports all 50 device hardware IDs into Contoso's Microsoft Entra ID tenant.

Next, Sarah creates an Autopilot deployment profile. She navigates to 'Devices > Windows > Windows Autopilot Deployment Profiles', clicks 'Create Profile', and configures the following settings:

Sarah then assigns this profile to a dynamic device group that contains all 50 imported devices. She also creates an Intune device configuration profile that enforces BitLocker encryption, Windows Defender antivirus settings, and a custom desktop background with the company logo. Finally, she creates a Microsoft 365 Apps deployment in Intune that automatically installs Word, Excel, Outlook, Teams, and OneDrive on every device.

A week later, the laptops arrive. Sarah distributes them to employees without touching a single device. When an employee named John unboxes his new laptop, plugs it in, turns it on, and connects to the office Wi-Fi, the device immediately contacts the Autopilot cloud service. It checks its hardware hash against the registered devices, finds a match, and downloads the 'Contoso Standard Laptop' profile.

The OOBE screen now shows 'Contoso Corp' branding. John enters his work email address (john@contoso.com). The laptop authenticates him against Microsoft Entra ID, automatically joins the device to the corporate tenant, and then the Enrollment Status Page (ESP) appears, showing progress bars for installing Microsoft 365 Apps, applying BitLocker, and setting up Windows Defender. After about 10 minutes, the ESP completes, and John sees his normal Windows desktop with the company wallpaper. He can immediately open Outlook and start working.

Sarah saved 40 hours of manual work. She also eliminated the risk of human error from manual imaging (forgetting to install a critical security update, using the wrong driver, or accidentally deploying to the wrong user). The entire process is auditable via Microsoft Endpoint Manager logs.

The day-to-day actions for Sarah now shift from 'imaging and deploying' to 'monitoring and refining'. She monitors the Autopilot deployment reports to see if any devices failed to register or if any profiles had errors. She updates the deployment profile to add new apps or change security settings, and those changes apply to new devices automatically. She no longer maintains a golden image or WDS server.