Windows Autopilot deployment modes and profiles
Windows Autopilot lets you ship a device to a user and have it configure itself over the internet. The exam tests the modes, the pieces involved and the order of steps.
How it works
- The device is registered with the Autopilot service, either by the OEM or reseller, or by you uploading the hardware hash (CSV) to Intune.
- You create a deployment profile and assign it to a group of devices.
- On first boot, the device finds the profile, joins Microsoft Entra ID, enrolls in Intune and applies policies and apps.
Autopilot profiles are assigned to device groups, not user groups. A dynamic group using the Autopilot group tag or order ID is a common way to target them.
Deployment modes
| Mode | User sign-in | Join type | Notes |
|---|---|---|---|
| User-driven | Yes | Entra join or hybrid join | Most common |
| Self-deploying | No | Entra join only | Kiosks, shared devices, needs TPM 2.0 with attestation |
| Pre-provisioning (formerly white glove) | Technician, then user | Entra join or hybrid join | Technician installs apps first |
Hybrid join with Autopilot needs the Intune Connector for Active Directory and a domain join profile.
Deployment profile settings
The profile controls the out-of-box experience (OOBE): language, whether to hide the license terms and privacy settings, the user account type (standard or administrator), and a device naming template.
Enrollment status page (ESP)
The ESP shows progress during setup and can block use of the device until required apps and profiles are installed. Settings include a timeout, blocking until installation is complete, and log collection on failure. If a failure scenario asks about logs, the answer is the ESP profile.
Reset and retire
- Autopilot Reset removes personal files, apps and settings but keeps the device in Entra ID and Intune, and keeps the Wi-Fi connection. It is used to hand a device to another user.
- Wipe reinstalls Windows. You can keep the enrollment state and user account.
- Delete the Autopilot record to remove the device from the service completely.
Exam traps
- Autopilot does not install an operating system image. It configures the existing Windows installation.
- Self-deploying does not support hybrid join.
- Profiles are assigned to device groups, not users.
- Deleting a device from Intune does not remove its Autopilot registration.
- White glove is the old name of pre-provisioning.
Practice questions
Choose an answer, then review the explanation to check your understanding.
1. New laptops ship directly to users. Each user signs in with a work account during setup and the laptop joins Microsoft Entra ID. Which Autopilot mode is this?
Show answer
Answer: B.User-driven mode ties the device to the user who signs in during the out-of-box experience.
2. A kiosk with no user must join Microsoft Entra ID without any sign-in. Which mode and requirement apply?
Show answer
Answer: B.Self-deploying mode needs no user credentials and requires TPM 2.0 with attestation.
3. When an Autopilot deployment fails, support cannot collect logs from the device. What do you configure?
Show answer
Answer: B.The enrollment status page (ESP) profile has a setting to turn on log collection and a "Collect logs" button on failure.
4. Which action registers existing devices so Autopilot can find them?
Show answer
Answer: A.Devices must be registered by hardware hash, by the OEM or reseller, or by a partner.