# Autopilot

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/autopilot

## Quick definition

Autopilot is a tool from Microsoft that helps businesses set up new computers automatically. Instead of an IT person manually configuring each device, Autopilot uses the internet to download settings and apps. This means a new laptop can be ready for work right out of the box, with no complex setup steps for the user.

## Simple meaning

Think of Autopilot like a new smartphone that you turn on for the first time. When you power it up, it asks you to connect to Wi-Fi, sign into your account, and then it automatically downloads all your apps, contacts, and settings from the cloud. You don't have to manually install each app or configure every setting because the phone knows who you are and what you need.

Now imagine that same experience for a work laptop. In the past, IT departments had to unbox each computer, manually install the operating system, join it to the company network, install security software, and then deliver it to the employee. That process could take hours per device. Autopilot completely changes this. When a new Windows device arrives from the manufacturer, the IT team simply registers its unique hardware ID (called a hardware hash) in a Microsoft cloud service called Intune or Microsoft 365. The device is then shipped directly to the employee.

When the employee opens the box and turns on the laptop, they are greeted with a familiar setup screen. They enter their company email and password. Behind the scenes, Autopilot reaches out to Microsoft's cloud, identifies the device, and applies all the pre-configured policies, applications, and security settings that IT has defined. The device is automatically enrolled in mobile device management, joined to Azure Active Directory, and configured with company standards. By the time the user sees the desktop, it is already a fully managed, secure, and productive device. No IT technician ever touched the hardware.

Autopilot essentially shifts the heavy lifting from manual hands-on configuration to intelligent cloud automation. It saves companies time, reduces errors, and gives employees a modern, consumer-like experience when they start a new job or get a replacement computer.

## Technical definition

Windows Autopilot is a collection of technologies built into Windows 10 and Windows 11 that enable the zero-touch deployment of new devices. It leverages cloud services from Microsoft, including Azure Active Directory (Azure AD), Microsoft Intune (part of Microsoft Endpoint Manager), and Windows Update for Business, to provision and configure devices without requiring any local IT infrastructure or manual imaging.

The core workflow begins with a hardware hash, a unique identifier generated from the device's TPM (Trusted Platform Module), disk, and network adapter. This hash is captured by the OEM or a partner during manufacturing, or by IT using a PowerShell script on an existing device. The hash is uploaded to the Microsoft Autopilot service, which associates the device with an organization's tenant. IT administrators then assign an Autopilot deployment profile to the device via Intune. This profile defines the out-of-box experience (OOBE) settings, such as whether to use Azure AD Join or Hybrid Azure AD Join, the user or device license type, language and region options, and the branding shown during setup.

When a user boots a registered Autopilot device for the first time, the device contacts the Autopilot deployment service during the OOBE phase. The service validates the device identity using the hardware hash and retrieves the assigned deployment profile. The device then proceeds with one of two primary deployment modes: User-driven mode (where the user signs in with their work or school account) or Self-deploying mode (for shared or kiosk devices where no user interaction is needed after connecting to a network). In both modes, the device is joined to Azure AD, enrolled into Intune, and receives the necessary configuration policies, security baselines, and application installations defined by IT.

Autopilot also supports a pre-provisioned deployment scenario, sometimes called "white glove." In this case, an IT technician or partner performs an initial setup to bring the device to a fully provisioned state before handing it to the user. The user still goes through a minimal OOBE, but the heavy lifting is done ahead of time. All of this works without imaging or sysprep; Autopilot uses the Windows 10/11 images pre-installed by the OEM, relying on cloud-based configuration to customize the device.

Key components include the Autopilot service itself (cloud API), Azure AD for identity, Intune for policy and app deployment, and the Windows OOBE client. From an exam perspective, candidates for MS-102 (Microsoft 365 Administrator) and MS-900 (Microsoft 365 Fundamentals) need to understand the prerequisites: a supported Windows edition (Pro, Enterprise, or Education), internet connectivity, Azure AD P1 or P2 licensing, and an Intune or Microsoft 365 E3/E5 subscription. Hybrid deployments require a connection to an on-premises Active Directory via Azure AD Connect.

## Real-life example

Imagine you order a new car online, and the manufacturer sends it directly to your driveway. When you sit in the driver's seat, the car already knows your preferred seat position, radio presets, climate control settings, and even your home address in the navigation system. You didn't have to spend an hour adjusting mirrors or programming radio stations because the car 'remembers' you from your account.

Now take that same idea and apply it to a company-issued laptop. In the traditional way, IT would have to receive the laptop, unbox it, turn it on, install Windows from a USB drive, manually join it to the corporate domain, install antivirus, office suite, and a dozen other applications, configure privacy settings, and then test that everything works. That process could take 45 minutes to two hours per device. Multiply that by 500 new hires, and you have a huge amount of labor.

With Autopilot, the experience is like that smart car. The company buys laptops from a manufacturer like Dell or HP. The manufacturer registers the laptop's unique serial number and hardware hash in Microsoft's cloud during production. IT defines a deployment profile once in Intune-choosing which apps to install, which security settings to apply, and how the user should sign in. When a new employee receives the laptop, they simply turn it on, connect to Wi-Fi, and sign in with their company email. The laptop automatically downloads everything it needs from the cloud. The user sees their custom desktop background, has Microsoft Teams and Office ready to go, and can start working immediately.

This analogy helps explain why Autopilot is so powerful: It removes the manual, repetitive, error-prone part of IT work. Just as a car that remembers your settings feels personal and saves you time, Autopilot makes each device feel personalized for the user while also ensuring that every company security policy is applied consistently. The IT team no longer has to touch the hardware, and the employee gets a modern, fast, and frustration-free start.

## Why it matters

In any organization, deploying new computers is a recurring and resource-intensive task. Without Autopilot, IT staff must physically handle each device, either by imaging it in-house or by coordinating with a vendor. This process introduces delays, especially when hiring spikes or when employees are in remote locations. Autopilot solves these problems by enabling a fully cloud-driven, zero-touch deployment model.

From a cost perspective, Autopilot reduces the time IT spends on manual setup. A technician who previously spent hours per device can instead manage hundreds of devices in a few minutes through Intune policies. This frees up skilled IT resources for higher-value projects like security improvements or user experience enhancements. Autopilot reduces the risk of configuration drift, where devices end up with slightly different settings due to human error during manual setup. Every device registered in Autopilot receives exactly the same policies and applications, ensuring consistency.

Security is another critical reason. Autopilot devices are automatically joined to Azure AD and enrolled in Intune, meaning they immediately receive compliance policies, conditional access rules, and security baselines. If a device is lost or stolen, IT can remotely wipe it without ever having had physical access. Also, because Autopilot uses the OEM's factory image, there is no risk of using a compromised or outdated image from a USB drive.

For global or remote workforces, Autopilot is transformative. An employee in a different country can receive a laptop directly from the manufacturer, turn it on, and be fully productive in minutes. IT does not need to ship devices to a central office first or rely on local IT staff. This supports modern hybrid work models where employees may never visit a physical office. Finally, Autopilot improves the employee experience-new hires feel welcomed by a device that is ready to go, which can positively impact first-day impressions and productivity.

## Why it matters in exams

For the MS-900 exam, Autopilot appears in the context of modern device management and cloud-based deployment. The exam objectives under "Describe the capabilities of Microsoft 365" include understanding how Autopilot simplifies device provisioning. Candidates should know the basic workflow, the prerequisites (Windows 10/11 Pro or Enterprise, Azure AD, Intune), and the difference between Autopilot and traditional imaging. MS-900 questions are often conceptual, asking learners to identify the correct scenario for using Autopilot or to compare it with other deployment methods like MDT or SCCM.

For MS-102, the depth is much greater. This exam targets Microsoft 365 administrators who plan, implement, and manage endpoint management solutions. Autopilot is a core topic under "Manage endpoints" and "Deploy devices." Candidates need to understand how to capture and upload hardware hashes, create and assign deployment profiles, configure enrollment status pages, and troubleshoot common deployment failures. Questions may present a scenario where a company is migrating from on-premises domain join to Azure AD join and must decide whether to use user-driven or self-deploying mode. Another common question type involves troubleshooting why a device does not appear in Autopilot after the hash is uploaded.

Both exams test the understanding that Autopilot is not an imaging tool-it works with the OEM Windows image. A frequent exam trap is that learners confuse Autopilot with Configuration Manager task sequences or with a tool that can reset an existing device. In reality, Autopilot is designed for new devices or for devices that are reset to factory settings and then reprovisioned. Candidates must also know that Autopilot requires a specific Windows edition (Pro, Enterprise, or Education) and that devices need to be registered in the Autopilot service via their hardware hash.

MS-102 may include questions on pre-provisioned deployment, also known as "white glove." This is a more advanced scenario where a technician performs initial provisioning on behalf of a user. Understanding the differences in user experience and licensing requirements for each deployment mode is essential for both exams.

## How it appears in exam questions

Autopilot appears in three main question patterns across the MS-900 and MS-102 exams: scenario-based, configuration-based, and troubleshooting-based.

Scenario-based questions typically describe a business challenge and ask which deployment solution best fits. For example: "A company is hiring 100 new remote employees who will receive laptops directly from the manufacturer. The company wants to minimize IT involvement and ensure that devices are secure and managed from the first boot. Which technology should they use?" The correct answer is Autopilot. Distractors might include Windows Configuration Designer, Deployment Image Servicing and Management (DISM), or a traditional task sequence in Configuration Manager.

Configuration-based questions ask about the steps needed to implement Autopilot. For instance: "You have purchased 50 new laptops from a vendor. You need to register them with Windows Autopilot. What should you do first?" Options might involve running a PowerShell script on each device to capture the hardware hash, importing the hash into Intune, or creating a deployment profile. The correct sequence is to first obtain the hardware hash, then upload it, then assign a profile. More advanced configuration questions might ask about the difference between a user-driven and self-deploying profile or about setting the enrollment status page to block use until all apps are installed.

Troubleshooting questions are more common in MS-102. A typical question: "A user reports that after signing into their new Autopilot device, they see only a blank desktop and no applications are installed. The deployment profile was assigned correctly. What is the most likely cause?" Possible answers: The device is not connected to the internet, the enrolment status page timeout is too short, or the user does not have an Intune license. The correct answer is usually related to licensing or network connectivity. Another troubleshooting pattern involves a device that appears as "Not registered" in the Autopilot devices blade in Intune even after the hash was uploaded-this could be due to a hardware hash mismatch or the device being manually reset.

Candidates should also expect questions that test the difference between Autopilot and other deployment methods. For example: "Which statement about Windows Autopilot is true?" Incorrect options might claim it requires a custom Windows image or that it works only with hybrid Azure AD join. The correct answer emphasizes that Autopilot uses the OEM image and supports both Azure AD join and hybrid join.

## Example scenario

Contoso Ltd. is a medium-sized company with 200 employees, many of whom work remotely. The IT team has traditionally set up new computers by first unboxing them in the office, installing Windows from a USB, joining the domain manually, installing all company software, and then shipping the device to the employee. This process takes about one hour per device and often leads to delays because devices must be shipped twice-once to the office and again to the remote employee.

Contoso decides to adopt Windows Autopilot to improve this process. The IT administrator, Sarah, starts by creating a deployment profile in the Microsoft Endpoint Manager admin center. She configures the profile for user-driven deployment with Azure AD join, sets the company branding (logo and support information), and enables the enrollment status page so that users see the installation progress. She also assigns the profile to a dynamic device group that contains all Autopilot-registered devices.

Next, Sarah orders 20 new laptops directly from a participating OEM. The OEM automatically registers the hardware hashes of these laptops with Contoso's tenant during manufacturing. When the laptops arrive at the employees' homes, each user turns on the laptop, selects their language and region, and connects to Wi-Fi. They then sign in with their Contoso email address and password. After signing in, the device joins Azure AD, enrolls in Intune, and begins installing Microsoft 365 Apps for enterprise, Teams, and the company's security software. The user can see the progress on the enrollment status page. Within 10 minutes, the desktop appears, and the user can start working-all without any IT involvement.

One employee, Mark, faces an issue where his laptop stays on the enrollment status page for a long time without proceeding. Sarah troubleshoots by checking the device's internet connection and verifying that Mark has an appropriate license assigned. She realizes Mark was not assigned an Intune license. After assigning the license in the Microsoft 365 admin center, Mark resets the device and the provisioning completes successfully. This scenario illustrates the power of Autopilot for remote deployments and the importance of correct licensing.

## Common mistakes

- **Mistake:** Thinking Autopilot replaces the need for an operating system image or deployment tool like MDT (Microsoft Deployment Toolkit).
  - Why it is wrong: Autopilot is not an imaging solution. It uses the Windows image that comes pre-installed by the OEM. It configures and customizes that image through cloud policies, but it does not modify the underlying OS files. For scenarios requiring a customized image (e.g., removing built-in apps or adding custom drivers), traditional imaging would still be needed.
  - Fix: Understand that Autopilot is a configuration and provisioning tool, not an imaging tool. Use it when you want to use the OEM image with cloud-based customization.
- **Mistake:** Assuming Autopilot can be used to re-deploy or reprovision an existing, already-configured device without a full reset.
  - Why it is wrong: Autopilot only works during the Windows Out-of-Box Experience (OOBE) phase. This means the device must be in a factory-fresh state or reset to that state. You cannot use Autopilot on a device that is already joined to a domain or has user data without first performing a Windows reset.
  - Fix: If you need to reprovision an existing device, either perform a fresh start or use Windows Autopilot Reset, which is a separate feature that works on existing Autopilot-registered devices to bring them back to a business-ready state.
- **Mistake:** Believing that Autopilot requires on-premises Active Directory and a VPN connection to function.
  - Why it is wrong: Autopilot is designed for cloud-first scenarios. It works primarily with Azure AD join, which does not require any on-premises infrastructure. While Hybrid Azure AD Join is supported, it does require connectivity to an on-premises domain controller, but the Autopilot process itself does not mandate a VPN.
  - Fix: Remember that Autopilot's primary deployment mode is Azure AD join (cloud-only). Hybrid join is an option but not a requirement. Autopilot works over the public internet, no VPN needed for cloud-joined devices.
- **Mistake:** Forgetting that Autopilot requires specific licensing for both the device and the user.
  - Why it is wrong: Autopilot itself is free, but the services it relies on-Azure AD P1 or P2 and Intune-require paid subscriptions. The user must have an appropriate license (e.g., Microsoft 365 E3 or E5) to be able to enroll the device in Intune.
  - Fix: Always verify that the user has an Intune license assigned and that the tenant has the necessary Azure AD P1 or P2 licensing. Unlicensed users will fail during the enrollment phase.

## Exam trap

{"trap":"A question asks: 'What must you do to prepare an existing device for Windows Autopilot deployment?' Many learners choose an answer like 'Install the latest Windows update' or 'Run the Autopilot deployment profile wizard on the device.'","why_learners_choose_it":"Learners often think Autopilot is a process that runs on any Windows device, similar to running a script or installing an update. They don't realize that Autopilot is only triggered during the OOBE, which requires the device to be in a reset state.","how_to_avoid_it":"Remember that Autopilot expects a clean slate: the device must be factory reset or brand new. The preparation step for an existing device is to capture its hardware hash using a PowerShell script, register that hash in Intune, and then reset the device to initiate the OOBE. Nothing else is needed."}

## Commonly confused with

- **Autopilot vs Microsoft Deployment Toolkit (MDT):** MDT is a traditional on-premises deployment tool that uses custom task sequences and a network deployment share to install a custom Windows image on devices. Autopilot is cloud-based and uses the OEM image, with no need for local servers or imaging. MDT is for legacy, high-customization scenarios, while Autopilot is for modern, cloud-first, zero-touch deployment. (Example: If an organization needs to deploy a custom Windows image with pre-loaded legacy drivers and apps, MDT is appropriate. If they want a simple, remote-friendly deployment with cloud management, Autopilot is the choice.)
- **Autopilot vs Azure AD Join (manual):** Azure AD Join is the action of connecting a Windows device to an Azure AD tenant. You can do this manually through Settings while logged in as a user. Autopilot automates the entire process of Azure AD Join, Intune enrollment, and policy application during the first boot, without any user needing to navigate through multiple settings screens. (Example: Manually going to Settings > Accounts > Access work or school and clicking 'Join' is a manual Azure AD Join. Autopilot does this automatically when the user signs in during OOBE.)
- **Autopilot vs Windows Configuration Designer (WCD):** WCD is a tool that creates provisioning packages (a .ppkg file) that can be applied to multiple devices to configure settings, install apps, and join Azure AD. The package must be manually applied via USB or email. Autopilot requires no package-the configuration is pulled from the cloud in real-time. WCD is a step above manual but still requires distribution of a provisioning file, whereas Autopilot is fully automated and cloud-driven. (Example: An IT admin uses WCD to create a provisioning package that joins devices to Azure AD and installs Office. They then put the package on a USB stick and insert it into each new device. Autopilot does the same thing without any USB-it uses the device's registered identity and internet connection.)

## Step-by-step breakdown

1. **Device Registration** — An IT administrator captures the hardware hash of each new device. This can be done by running a PowerShell script on the device or by working with an OEM that automatically uploads the hash during manufacturing. The hash is uploaded to the Microsoft Autopilot service via Intune or the Microsoft 365 admin center.
2. **Create Deployment Profile** — In Microsoft Endpoint Manager, the admin creates an Autopilot deployment profile. This profile defines the OOBE settings: deployment mode (user-driven, self-deploying, or pre-provisioned), join type (Azure AD Join or Hybrid Azure AD Join), privacy settings, language/region, and branding. The profile is then assigned to a device group.
3. **Assign Profile to Devices** — The admin ensures that registered Autopilot devices are members of a group that has the deployment profile assigned. This association tells the Autopilot service which settings to apply when a specific device connects during OOBE.
4. **Device Ships to User** — The device is sent directly from the manufacturer or IT to the end user. It does not need to be pre-configured. The user receives a sealed box with the device inside, ready for first boot.
5. **User Boots Device and Connects to Internet** — The user turns on the device and goes through the standard Windows OOBE. They select language, region, and keyboard layout. They connect to a Wi-Fi or wired network. At this point, the device contacts the Autopilot service online.
6. **Device Authenticates and Retrieves Profile** — The Autopilot service recognizes the device using its hardware hash. It identifies the associated deployment profile and sends the configuration instructions back to the device. The device then proceeds with the required join type.
7. **User Signs In** — The user is prompted to sign in with their work or school account (for user-driven mode). Authentication happens via Azure AD. The device is joined to Azure AD and enrolled in Intune during this step.
8. **Policy and App Deployment** — Once enrolled, Intune automatically pushes all configured policies, security baselines, and required applications to the device. The user can see progress on the Enrollment Status Page. After completion, the desktop appears and the device is fully managed and ready for use.

## Practical mini-lesson

Windows Autopilot is more than just a set-up wizard-it is a fundamental shift in how organizations approach device lifecycle management. To implement it effectively, IT professionals need to understand the prerequisites and planning steps thoroughly.

First, licensing and subscriptions are non-negotiable. While Autopilot itself does not incur an extra fee, the underlying Microsoft 365 or Intune subscription is required. For user-driven and self-deploying modes, you need Azure AD P1 or P2 licensing. Each user who will use an Autopilot device must have an Intune license (included in Microsoft 365 E3/E5 or standalone). Without proper licensing, the device will fail enrollment during the OOBE. This is one of the most common real-world failures.

Second, hardware hash collection is a critical step that must be done correctly. For existing devices, you can use the Get-WindowsAutopilotInfo PowerShell script from the PowerShell Gallery. The script exports the hardware hash to a CSV file, which you then import into Intune. For new devices, working with an OEM that supports Autopilot registration is far more efficient. Microsoft has partnerships with Dell, HP, Lenovo, and others that can automatically register devices during manufacturing. This eliminates the need for an IT person to ever touch the device before it reaches the user.

Third, deployment profile design requires careful consideration. The choice between user-driven and self-deploying mode determines how much user interaction is needed. User-driven is typical for personal, single-user devices. Self-deploying is ideal for shared devices like kiosks or digital signage. Pre-provisioned deployment (white glove) is useful when a technician wants to complete the heavy provisioning (app installs, policy application) before the user gets the device, reducing user wait time. Each mode has different licensing and hardware requirements-self-deploying mode, for example, requires Windows 10/11 Enterprise or Education, and a TPM 2.0 chip.

Fourth, troubleshooting is a reality. Common issues include devices not appearing in Autopilot list (hash not uploaded or wrong tenant), deployment profile not applying (group membership issue), and enrolment failures due to licensing. Another subtle issue is network connectivity: the device must be able to reach the Microsoft Autopilot service endpoints (specific URLs that need to be allowed through firewalls and proxies). Administrators should also monitor the Enrollment Status Page timeout settings-if apps take too long to install, the page may time out and leave the device in an incomplete state.

Finally, professionals should integrate Autopilot with other tools. For example, dynamic Azure AD groups based on device model or enrollment profile can simplify profile assignment. Conditional access policies can enforce compliance after Autopilot completes. And Windows Update for Business rings can control which feature updates the devices receive. Autopilot is rarely a standalone project-it is part of a broader modern device management strategy that includes Intune, Azure AD, and Microsoft 365 security features.

## Memory tip

Remember 'A-P-P-L-E' for Autopilot: A, Azure AD join, P, Profile in Intune, P, Policy pushed from cloud, L, License for user, E, Enrollment status page.

## FAQ

**Do I need to manually create a Windows image when using Autopilot?**

No. Autopilot uses the Windows image that comes pre-installed on the device by the manufacturer. You do not need to create or deploy custom images. All configuration is applied through cloud policies after the device connects to the internet.

**Can I use Autopilot on an existing device that is already in use?**

Autopilot is designed for new or factory-reset devices. For existing devices that are already in use, you can capture their hardware hash, register them in Autopilot, and then perform a Windows reset to trigger the Autopilot OOBE. However, this will erase all data and apps on the device.

**What happens if the internet connection is lost during the Autopilot setup?**

If the internet connection drops, the Autopilot process will fail or stall. The device may revert to a standard OOBE or show an error. The user will need to restart the setup with a stable internet connection. It is essential to have reliable connectivity during the entire provisioning process.

**Is Autopilot available for Windows 10 Home edition?**

No. Autopilot is only available on Windows 10 Pro, Enterprise, and Education editions. Windows 10 Home does not support Azure AD join or Intune enrollment, which are required for Autopilot.

**Can I deploy applications using Autopilot?**

Yes. You can deploy applications through Intune by assigning them to the device group during the Autopilot profile configuration. The apps are installed automatically either during the OOBE (if configured in the enrollment status page) or shortly after the user reaches the desktop.

**Do I need on-premises Active Directory to use Autopilot?**

No, not for the primary cloud-joined deployment. Autopilot supports both Azure AD join (cloud-only) and Hybrid Azure AD join (which requires on-prem AD). If you choose cloud-only, no on-premises infrastructure is needed.

## Summary

Windows Autopilot represents a modern approach to device deployment that leverages cloud intelligence to eliminate manual IT workloads. By shifting the setup process from on-premises servers and imaging systems to cloud-based policies and identity management, Autopilot enables organizations to deploy devices anywhere in the world with minimal hands-on effort. For IT professionals, understanding Autopilot is no longer optional-it is a core skill for the modern workplace.

From an exam perspective, MS-900 candidates should focus on the conceptual understanding: what Autopilot does, its prerequisites, and the benefits over traditional deployment. MS-102 candidates need deeper operational knowledge, including how to collect hardware hashes, create and assign deployment profiles, troubleshoot failures, and choose between deployment modes. Both exams test the distinction between Autopilot and tools like MDT, SCCM, or manual Azure AD Join.

The key takeaway for learners is that Autopilot is not about imaging-it is about configuration on top of a standard OEM image. It requires proper licensing, internet connectivity, and registered hardware hashes. When implemented correctly, it provides a seamless user experience and significant time savings for IT teams. Remember the common traps: licensing, device registration, and the requirement for a factory-fresh state. Mastering Autopilot will serve you well in both certification exams and real-world IT administration.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/autopilot