How to register devices for Windows Autopilot

Registering a device for Windows Autopilot means getting its hardware identity into your tenant's Autopilot device list — by the OEM at purchase, or by importing a hardware-hash CSV — and then letting a dynamic group pick it up and a deployment profile attach to it. Once the profile status reads Assigned, the device can be shipped sealed to the user; it will find the tenant on first boot.

What Autopilot does, the deployment modes (user-driven, self-deploying, pre-provisioning), and how it fits with Entra join are in Intune Windows Autopilot. This page is the registration mechanics, and it assumes the Intune baseline — enrolment restrictions, compliance, a configuration baseline — is in place.

Prerequisites

Intune Administrator (or Global Admin) with an Intune licence; Autopilot is included with Intune Plan 1 and therefore with Business Premium, E3, E5, F1, F3.
Automatic enrolment configured: Intune → Devices → Windows → Enrollment → Automatic Enrollment, MDM user scope All (or the pilot group).
Company branding set in Entra (Company branding), because the Autopilot sign-in page shows it and users notice.
For OEM registration: your tenant ID (Entra → Overview) or the primary domain, and the group tags you want stamped.
For the CSV route: a device you can run PowerShell on, or a technician who can boot it to OOBE.

Steps

Progress 0/5

1.OEM registration (preferred)↓
2.Manual registration by hardware hash↓
3.Create the dynamic device group↓
4.Create and assign the deployment profile↓
5.Assign an Enrollment Status Page↓

Progress is saved in this browser only.

1. OEM registration (preferred)

When ordering, give the vendor your tenant ID and the group tag(s) to apply. Most vendor portals — Dell TechDirect, HP, Lenovo — also let you register devices already bought. Devices appear under Intune → Devices → Windows → Enrollment → Devices (Windows Autopilot) with the tag set. Check the first batch before authorising the rest.

2. Manual registration by hardware hash

On the device, in OOBE press Shift+F10 for a command prompt, or on a running Windows install as admin:

PowerShell

Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile C:\hash.csv -GroupTag "KW-EU"

Or skip the CSV entirely and upload straight from the device with Get-WindowsAutopilotInfo -Online -GroupTag "KW-EU", which signs in with an Intune admin account and registers in one go — the fastest route for a handful of devices.

For the CSV: Intune → Devices → Windows → Enrollment → Devices → Import, pick the file (up to 500 rows). Import validates for a few minutes; failures are usually a device already registered to another tenant — see rebuilding Autopilot after a tenant change.

3. Create the dynamic device group

Entra → Groups → New group, type Security, membership Dynamic Device. For all Autopilot devices:

Code

(device.devicePhysicalIDs -any (_ -startsWith "[ZTDId]"))

Per group tag:

Code

(device.devicePhysicalIDs -any (_ -eq "[OrderID]:KW-EU"))

The tag is stored as OrderID for historical reasons. One group per profile you intend to assign.

4. Create and assign the deployment profile

Intune → Devices → Windows → Enrollment → Deployment Profiles → Create profile → Windows PC. Typical knowledge-worker settings: Deployment mode: User-Driven, Join to Microsoft Entra ID as: Microsoft Entra joined, skip privacy settings and EULA, User account type: Standard (never Administrator for ordinary users — that is what Endpoint Privilege Management is for), Allow pre-provisioned deployment: Yes, a device name template such as CONTOSO-%SERIAL%. Assign to the dynamic group from step 3.

5. Assign an Enrollment Status Page

Enrollment → Enrollment Status Page: show progress, block device use until required apps install, and list the apps that must be present before the desktop appears (the Microsoft 365 Apps package from Intune app deployment for Microsoft 365 Apps, the security agent, the VPN client). Assign to the same group. Without an ESP, the user gets a desktop before the device is compliant and compliance-gated Conditional Access blocks them.

Verify

The device row under Devices (Windows Autopilot) shows the group tag, and Profile status: Assigned. Not assigned after 30 minutes means the dynamic group rule does not match — check the tag spelling.
Reset one device (Settings → Recovery → Reset, or sysprep/fresh install) and walk through OOBE: the company-branded sign-in page appears after the network step, the ESP runs, and the device lands Entra joined and enrolled in Intune under the signed-in user.
In Intune the device shows compliant once the compliance policy evaluates (allow an hour).

Roll back

To unregister a device, Devices (Windows Autopilot) → the device → Delete; if it is also enrolled, retire or delete the Intune device object first, then the Autopilot record, then the Entra device object, in that order, and wait for each to complete. Changing a device's group tag re-routes it to a different profile on the next dynamic-group evaluation without re-registration. Removing a profile assignment leaves devices in Not assigned — they will OOBE as ordinary consumer Windows, which is the state you want to avoid shipping in.

Frequently asked questions

Do I need to collect hardware hashes if the OEM registers devices?

No. Dell, HP, Lenovo, Microsoft, and most resellers can register devices to your tenant at purchase using your tenant ID or domain, which is the intended path at scale. The hardware-hash CSV route is for existing devices, one-off purchases, and vendors who do not offer registration.

What is a group tag in Autopilot?

A free-text attribute on the Autopilot device record, set at registration or afterwards, that you can match in a dynamic group rule. It is how you route devices to different deployment profiles — kiosk versus knowledge worker, region A versus B — without touching each device. Agree the tag values with your OEM before ordering.

How long after registration does a device show up in Intune?

The Autopilot device record appears within minutes of import (up to 15 minutes for a large CSV). The dynamic group that targets it evaluates on its own schedule — typically minutes, occasionally longer in busy tenants — and the deployment profile shows 'Assigned' on the device once the group membership has been processed. Do not ship a device to a user until the profile status reads Assigned.