Windows Autopilot The box is shipped from the supplier and arrives at the user's location. The machine sets itself up automatically.
It can be proven in five minutes. It's happening somewhere else.Every service provider will show you the same demo: a brand-new cell phone, a network, a password, and a device ready to use in twenty minutes. That’s accurate. But what really determines success isn’t included: who registers the device with the provider, what causes it to get stuck on the loading screen, and what happens when the device is sent in for repair.
What's Really Going On
Five steps, and the fifth one is the one that fails.
Here’s what the computer does between the moment the user turns it on and the moment they see their desktop. The first four steps almost always work; the fifth is when you end up waiting twenty minutes in front of a blue screen, and that’s where the project’s reputation with users is at stake.
The user chooses their network
This is the only step that’s truly mandatory. Without a network connection, nothing happens: the machine can’t tell who it belongs to.
What Might Go Wrong:A corporate network that requires a certificate that the machine does not yet have. The solution: set up an open guest network, or have the machines boot from a removable drive.
The machine is ready for service
It sends its digital fingerprint. The service recognizes it, knows which company it belongs to, and returns the profile assigned to it.
What Might Be Wrong: Themachine was never registered, or was registered under the wrong customer. It then starts up as a personal computer. This is something that needs to be resolved with the provider, not in the console.
The welcome screen adopts your color scheme
The company name appears, unnecessary screens are skipped, and the user sees nothing but a prompt for login credentials.
What might go wrong? Nothing, generally speaking. This is the part you see in a demonstration, and it’s also the most reliable.
The machine joins the directory and registers
It joins the directory—either on its own or in hybrid mode with your domain—and then registers in Intune. It is assigned a name based on the rule you have set.
What Might Go Wrong: Inhybrid mode, the device must join a domain controller, so it must be on your network or behind a remote access connection. A device delivered to an employee’s home cannot join in hybrid mode.
The status screen keeps the user engaged during installation
This screen blocks access to the desktop until the applications and settings are installed. It exists for a good reason: without it, the user would log in to a workstation that is only partially configured and start working on it.
What can throw everything off: an app that’s too resource-intensive, a failed dependency, a timeout that’s too short, or a lock policy that’s too broad. This is what makes the difference between “twenty minutes” and “an hour and a half.”
This process explains why a demonstration always succeeds, but a deployment does not always: in a demonstration, there is only one machine, an open network, and two applications. The real work involves deciding what absolutely must be installed before the user even touches the keyboard, and letting the rest happen afterward.
The choice made at the outset
Two Autopilot, and they don't mix.
Microsoft has added a second, simpler mechanism called device preparation. This is not a new version of the first one: it is a different approach with different prerequisites. And a device that has already been registered in the first mechanism cannot go through the second one —the classic profile takes precedence over the preparation policy.
| What's Changing | Autopilot classic | Preparing the batter |
|---|---|---|
| Pre-registration | Required. The physical copy must be submitted to the department by the supplier or by you. | None. That's the main change: no more fingerprints to collect, no more files to upload. |
| Version of Windows | Any version of Windows is still supported. | Windows 11 24H2 or later—or 22H2 and 23H2, provided you have the March 2024 update. |
| Junction Type | Directory only or hybrid mode with your domain. | Directory only. Hybrid mode is not supported, and this is the limitation that most often proves to be the deciding factor. |
| Application Assignment | In groups, which are often active: the device must first join the group, which takes some time. | The device is added to a group upon registration and immediately receives whatever is assigned to that group. |
| Deployment Monitoring | Summary. We know that a mission has failed, but we rarely know why without reading the newspapers. | Detailed and near real-time: status by application, by script, and duration. That's the second real benefit. |
| User Rights | Must be explicitly configured in the profile. | Defaultstandard user: the correct setting is the one you get without doing anything. |
| Scenarios Covered | Five, including setup in the workshop and resetting. | Two: user-controlled or automatic. No preparation required in the workshop. |
Our take—and we’ll be frank about it— is that device preparation is the right choice for a new fleet, fully integrated with the directory and running Windows 11. The traditionalAutopilot remains necessary whenever there’s a hybrid mode, devices that need to be prepared in the workshop before handover, or a base of older systems. Both can coexist within the same facility, on different production lines—but never on the same machine.
What it can do
Five uses, and the last one goes through your server.
Autopilot It is not a single mechanism but five different uses, and we never use just one: a corporate IT infrastructure uses two or three, depending on the type of workstation. The fifth is the one we tend to overlook, and it is precisely the one that allows us to take over an existing IT infrastructure without buying a single machine.
User-driven
The machine is shipped directly to its recipient, who unpacks it, connects it, and waits. The device identifies itself, registers, and receives its applications and policies.
For routine renewal and for remote work.Self-deployed
The machine configures itself entirely on its own, without anyone operating it. It requires a security chip and a hardware certificate, which excludes most virtual machines.
Terminals, classroom displays, shared workstations, workshops.Pre-stocking
Most of the work is done before delivery: resource-intensive applications are installed, settings are configured, and the machine is packed in a box. All the user has to do is log in.
When the wait for the status screen is considered too long.Reset
A workstation returned by one employee is ready for the next one, without the need for a complete reinstallation or a trip to the service center. It also provides a solution to software failures.
Team rotation, locked position, change in assignment.Autopilot for existing devices
Your current workstations—even those that have been connected to the domain for ten years—are reinstalled and switched over to Autopilot through a sequence of tasks: Configuration Manager. The workstation reappears in the directory, registered, and ready to use.
The only way to recover an installed base.Two of these five require the classicAutopilot
Resetting and pre-provisioning are not covered by device preparation. This point is often the deciding factor in choosing which mechanism to use, more so than the version of Windows installed.
Decide before you choose, not after." Autopilot s for existing devices" is a series of tasks, not an online service
This is the most useful mechanism for a company that already has a fleet of computers, and it’s also the one nobody talks about. It uses a nativetask sequence from Configuration Manager: it formats the workstation, reinstalls Windows from your image, applies the configuration Autopilot, and lets the machine boot into the welcome experience.
Two details that can cost you an entire evening if you’re not aware of them. The configuration file must be named exactly AutopilotConfigurationFile.json and encoded in ASCII or ANSI: if it’s in UTF-8 or Unicode, the machine boots normally and the “ Autopilot ” experience doesn’t trigger, without any error messages. And the pre-capture preparation step deletes this file: you need to be aware of this; the workaround is documented.
This method also allows you to convert hybrid-mode extension numbers to directory-only extension numbers—which the “Convert all targeted devices” setting does not do, despite its name.
Do you already have a Configuration Manager ? Then you're already halfway there.
The task sequence is native; the local client installs itself on the prepared workstation, and the machine becomes co-managed without any additional action. The integration of the two tools depends on four conditions, and we can verify them in half a day.
Autopilot It all comes down to the launch, not the rollout.
When a machine is added to the fleet, the process is well documented and well marketed. Its removal, however, is not documented anywhere—and that’s where devices are produced that are never recovered again. Repair, end of life, resale, motherboard replacement: four common situations, and each has its own pitfalls.
The order of the steps is non-negotiable
First, remove the device fromIntune, then from the service Autopilot. Skipping a step or reversing the order leaves orphaned records—and puts the device in a state from which it cannot be restored without the help of the publisher.
Never delete the object manually from the directory
Autopilot relies on this object to recognize the machine before the user logs in. Deleting it just to be on the safe side is the action that causes the most registration failures. In hybrid mode, you must remove the object from the local domain, not the one from the online directory.
A cancellation by the provider is not sufficient
When a reseller removes a device on their end, they take it offAutopilot —but they do not unregister it fromIntune or remove it from the directory. The machine remains partially in your fleet, and no one notices until the next reinstallation.
That’s why we write the checkout procedure before the check-in procedure, and why we have your teams test it on an actual machine. A company that knows how to check out a workstation properly will inevitably know how to check it in. The reverse is not true, and that only becomes apparent after a year—when the first devices come back from repair.
Our Approach
The recording belt is adjusted before the first machine.
There are five steps, and the first one is the one we almost always skip: agreeing with your equipment provider, your team, and your client on who records what. A Autopilot project that starts with the console starts in the middle.
The recording chain, from the supplier to the console
Who purchases it, who registers it, under what terms, and how you verify this upon receipt. We contact your reseller or distributor to obtain registration authorization, and we describe the checks to be performed on each delivery.
When equipment comes through us—we’re a Gold-level partner Dell Technologies — it is registered before shipment, and the machine arrives ready for use at the recipient’s location. We also handle equipment that has already been purchased: collecting fingerprints from existing machines or running them through the task sequence.
The choice of mechanism—and it is justified
Autopilot Standard setup or device configuration? The answer depends on three questions: Do you need hybrid mode? Do you need to configure devices in the workshop? And what is your system infrastructure?
We write the response and the reason. Both mechanisms can coexist within the same tenant, on different groups—but never on the same machine.
The status screen, configured for real-world applications
This is the step that determines the project's reputation. We separate what absolutely must be installed before the user even touches the keyboard from what can come later, and then we measure the actual time on a real machine.
This is the decisive step: if the wait is still too long, we change the partitioning—and if it’s still too long after that, we switch to pre-provisioning and let you know.
The discharge procedure—tried before it was needed
Repair, end-of-life, resale, reset for a new employee: four steps, in a set order. We write them down, and your teams perform them once on an actual machine right in front of us.
It consists of five pages of documentation and a one-hour test. It also prevents us from making devices in the second year that no one wants anymore.
Commissioning, and What Remains After We're Gone
Roll out in waves, starting with an entire service rather than three lab machines. Your teams should be able to set up a workstation without our help starting with the second wave.
We also handle communications with the vendor's support team when a device ends up in a state that cannot be resolved from the console: this happens, and it's a job in its own right.
What You Should Know Beforehand
Six points to consider, and everyone has their own answer.
None of these are deal-breakers, and none are reasons to give up. These are the six areas where a project Autopilot can fall behind, and each one can be resolved —provided they are identified before setting a delivery date for users.
Autopilot does not install a system image
This is the most common misconception, and it stems from a bygone era. Autopilot starts with the Windows that the manufacturer has installed and transforms it into a corporate workstation. It does not format anything, does not deploy any images, and does not handle drivers on a per-model basis.
That's good news: you no longer have to maintain a reference image for each laptop model, which used to be one of the most thankless tasks. And for machines with an empty hard drive, the task sequence Configuration Manager is still there.
The physical footprint is changing, and a motherboard breaks it
The fingerprint is recalculated each time it is generated: the service takes this into account and can identify a machine whose hard drive has been replaced. However, if the motherboard is replaced, the fingerprint no longer matches, and the device is no longer recognized.
The answer is simple and comes up only once: the return-from-shop procedure calls for regenerating and reapplying the imprint. We do this during the checkout process, and it only takes a few minutes per machine— provided that someone knows it needs to be done.
A device without an assigned profile receives the default profile
This is not a configuration error; it is the expected behavior. A machine that is registered but not included in your groups will use the tenant's default profile, which is almost never the one you want.
The solution lies in a well-written assignment rule and a check upon receipt— two things we establish in the first step. The corollary is useful: if a machine is NOT supposed to go through Autopilot, its registration must be removed—not just removed from the group.
Hybrid mode requires that the machine detect a domain controller
A device that needs to join your domain must be able to connect to it, which means it must be on your network or behind a remote access connection configured for that purpose. A laptop delivered directly to an employee’s home cannot join in hybrid mode.
There are two options, and one is clearly better: either you set up the device through a website before handing it over, or you add it to the directory on its own. Microsoft now recommends the second option for new devices, and it’s also the one that allows for direct delivery. Hybrid setup is still supported for existing devices.
The directory connector has a minimum version; if the version is lower than that, it does nothing.
If you join in hybrid mode, a connector runs on a server in your domain. Versions prior to 6.2501.2000.5 no longer process any enrollment requests: deployments fail, and the error message does not explain why.
The fix is quick and seamless: we install the updated connector on another server before removing the old one. This is the first thing we check on a network that connects in hybrid mode, and it can be resolved in a single morning.
Virtual machines and remote desktops are a special case
The self-deployed scenario requires hardware attestation, which most virtual machines do not provide. And a duplicate image created after registration is not manageable: the token ends up being duplicated, and the device fails to synchronize.
The rule is simple and easy to remember: clone before registration, never after. For remote desktop workstations, the process is different and well-documented; we treat it as a separate project rather than forcing Autopilot where it is not intended.
Frequently Asked Questions
What we're asked to do before we begin.
Seven questions that come up on every first date.
Do we have to replace our entire fleet to us Autopilot ?
No. That’s the most common concern, and the answer is the fifth scenario: “ Autopilot s for Existing Devices” reinstalls your current workstations through a sequence of tasks Configuration Manager and brings them back online, connected to the directory, registered, and ready to go.
No new machine is required. However, you will need a Configuration Manager running on a supported version and an Windows in your library—two things we verify during the scan.
Who is responsible for registering the machines: us or our supplier?
Ideally, your supplier: that’s what they’re there for, and it’s the only way to get a machine that’s ready to use without you having to set it up yourself. The manufacturer, retailer, or distributor can register the devices on your behalf once authorization has been granted.
We set up this process with your supplier and outline the inspection to be performed upon receipt. You can also register the items yourselves by collecting the fingerprints: it takes longer, but it is sometimes the only option for equipment purchased outside of a contract.
How long does the user wait in front of the screen?
It depends on just one thing: what you decided to install before handing it back to him. A basic setup—security, networking, office suite—can be set up quickly. A list of fifteen business applications, however, cannot.
That’s why we measure actual time on a real machine in step three, rather than announcing a figure up front. And when the wait is still too long despite the splitting, the solution is clear: pre-provisioning does most of the work before delivery, and the user simply waits for their connection.
Can we keep our jobs at the estate?
Yes. Hybrid mode connectivity is supported by the standardAutopilot and remains supported: your current devices are not at risk, and you are under no obligation to switch.
For new machines, Microsoft now recommends linking to the directory only, and this is also what enables direct delivery to the customer's home. The question therefore arises at the time of renewal, not now—and it is addressed on a model-by-model basis if necessary.
What happens if a device is sent in for repair?
It's no big deal, as long as you follow the proper procedure. A replaced hard drive is still recognized. A replaced motherboard, however, is not: you have to regenerate the fingerprint and resubmit it.
The real risk isn't technical: it's that a device will leave the fleet without anyone properly removing it in the correct order. That is exactly the purpose of our fourth step, and it involves five pages of documentation plus an hour of testing.
Does this replace Configuration Manager ?
No, and the two even work together: the sequence of tasks that migrates an existing fleet to Autopilot is a function of Configuration Manager. A workstation set up by Autopilot can host the local client and become co-managed.
Autopilot replaces the reference image for each machine model and eliminates the need to go through your workshop. The rest—installation on a bare-metal machine, closed networks, servers—remains the responsibility of the local tool. Details can be found on the page Configuration Manager.
Do I need an additional license?
Autopilot It is not billed separately. Instead, it requires what any modern job management system requires: a license Intuneand a paid directory tier for automatic registration.
Most Microsoft 365 business subscriptions already include both. We check the billing statement to make sure, because that’s not the case for all of them—and because it’s better to find out before ordering hardware than after.
Around the New Station
The four pages that complement each other.
Autopilot covers the holder, the local tool, and the identity that connects them. Each of these pages covers one aspect, without repeating the others.
Is there an acronym you don't understand? They're all explained in plain language in our glossary .
Let's start with your recording setup
One hour with the engineers who will be doing the work, and the name of your hardware supplier. We’ll tell you who needs to register what, which system is right for your fleet, and what to expect upon delivery— including when the best approach is to start with your existing workstations rather than placing an order.
Preparing the proposal is free; assessing the existing conditions is the first step in the project. We are happy to arrange a meeting with the engineers who will be doing the work. We have been authorized to provide staffing services since 2018: an engineer can also join your team for a fixed term.
The last cell phone you received: Had anyone registered it before it was delivered?
If so, your channel already exists: Autopilot will be a set of guidelines and procedures, not a project.
If the answer is “he stopped by the office first, ” that’s exactly what we’ ve just eliminated—and it’s the part of the work that shows results the fastest, starting with the very next delivery.