Autopilot Device Preparation: The Next Evolution in Windows Deployment

Windows Autopilot changed how organisations deploy devices: out-of-box provisioning, automatic enrolment, and a consistent first-run experience. But for all its strengths, the classic Autopilot experience (v1) has some persistent friction points: hardware hashes need to be imported and pre-registered before a device can even start, the Enrolment Status Page (ESP) can stall with little useful information, and visibility into what's actually happening during setup is often limited until something goes wrong.

Autopilot Device Preparation, sometimes called "Autopilot v2", is Microsoft's answer to a lot of that friction. It's a leaner, cloud-first deployment path designed for Windows 11 and Entra ID join, and it's worth understanding both what it does well and where it doesn't (yet) replace classic Autopilot.

What is Autopilot Device Preparation?

Device Preparation is designed for Windows 11 devices joining Entra ID. Unlike classic Autopilot, there's no need to import hardware hashes or pre-register devices before deployment; the process starts after the user signs in with their organisational account.

Key features include:

• No hardware hash imports or device pre-registration required
• Deployment starts after sign-in, rather than before
• Support for up to 10 apps and 10 PowerShell scripts during provisioning
• Real-time status and diagnostics during setup
• Cleaner, more informative setup messages for end users

It's like a lighter version of Autopilot for cloud-first setups: less configuration overhead up front, in exchange for a more constrained (but simpler) deployment payload.

Autopilot v1 vs. Device Preparation (Autopilot v2)

Rule of thumb: if you need Hybrid Join, heavy app payloads, or pre-provisioning, stick with v1. If you want fast, simple, Entra-joined Windows 11 deployments, v2 is the way forward.

Business Use Case

Device Preparation is a strong fit for organisations that want to reduce admin overhead, simplify deployment, and get new starters up and running faster, with much better visibility into what's happening along the way. It's particularly well suited to remote workers, growing teams that need to onboard devices quickly without IT physically touching every machine, and organisations migrating to Windows 11 and Entra ID who don't need the full weight of classic Autopilot's configuration options.

Prerequisites

Before configuring Device Preparation, make sure the following are in place:

Operating System: Windows 11 22H2 or 23H2 with KB5035942 or later, or Windows 11 24H2 and above.

Licensing: Microsoft 365 Business Premium, E3, or E5, along with Intune and Entra ID.

Network Access: Devices need access to the relevant Microsoft endpoints during OOBE. See Microsoft's guidance on Device Preparation network requirements and the Intune network endpoints reference.

Tenant Setup:

• Enable automatic Intune enrolment
• Allow Entra ID Join for the relevant users/devices
• Create a user group for policy assignment
• Create a device group, with the Intune Provisioning Client added as an owner

Corporate Identifiers: If BYOD is blocked in your tenant, you may need a CSV of corporate device identifiers (Manufacturer, Model, Serial Number) so eligible devices can be correctly recognised.

Conditional Access Considerations

Because a device isn't yet compliant during OOBE, Conditional Access policies that require compliant devices need careful handling. Specifically:

• Exclude the "Microsoft Intune Enrolment" and "Windows Azure Active Directory" cloud apps from CA policies that require a compliant device; otherwise the device will fail at the point it most needs access.
• Consider MFA carefully for new users going through Device Preparation for the first time; SMS or Temporary Access Pass (TAP) can help bridge the gap where the user doesn't yet have an authenticator app configured.
• Compliance enforcement should happen after enrolment completes. Exclude the Intune Enrolment and Azure AD apps from compliance checks during OOBE, while still enforcing compliance for apps like Exchange, Teams, and SharePoint once the device is fully provisioned.

How to Configure Device Preparation

1. Create your groups. You'll need a user group (for assigning the Device Preparation policy) and a device group (for assigning apps and scripts). The device group can be dynamic, useful for BYOD scenarios, and it's good practice to assign your security policies to the device group as well.

2. Make the Intune Provisioning Client an owner of the device group. In the Entra admin centre, go to Groups, select your device group, open Owners, and add the Intune Provisioning Client (App ID f1346770-5b25-470b-88bd-d5744ab7952c) as an owner. Without this step, the device group won't be selectable when you create your Device Preparation policy.

3. Assign apps and scripts to the device group. You can assign up to 10 apps (Win32, Microsoft Store, Microsoft 365, or line-of-business apps) and up to 10 PowerShell scripts, which run in the system context during provisioning.

4. Create the Device Preparation policy. In Intune, go to Devices → Windows → Windows enrolment → Device Preparation policies → Create. You'll configure:

   • Deployment settings: user-driven mode, Entra join, and the account type for the device.
   • OOBE settings: timeout behaviour, the error message shown to users, a diagnostics link, and whether users can "continue anyway" if something fails.
   • Apps and scripts: select from what you assigned to the device group in step 3.
   • Assignments: assign the policy to your user group.

5. Deploy. The user signs in with their organisational account, Device Preparation runs, the assigned apps and scripts install, and the user lands on their desktop. For Cloud PC deployments, assign the policy to your licensed user group and use a dynamic device group that targets Cloud PC models; you can use provisioning policy names to dynamically capture the right Cloud PCs.

Limitations

Device Preparation is intentionally lean, and that comes with some constraints worth planning around:

• Windows 11 only, and Entra ID Join only: no Hybrid Join support
• Maximum of 10 apps and 10 PowerShell scripts
• No support for pre-provisioning or self-deploying scenarios
• If a device is already registered for classic Autopilot (v1), v1 takes priority
• Some gaps remain around custom compliance policies, and Managed Installer isn't supported during OOBE
• Dynamic grouping can be tricky for off-the-shelf devices; if BYOD is blocked, you may need separate Corporate Identifier lists per entity, and potentially multiple policies

Troubleshooting Tips

• Device shows the classic ESP instead of Device Preparation: the device is likely still registered for Autopilot v1; deregister it and try again.
• Device Preparation doesn't start: check the OS build and KB level, confirm the signed-in user is a member of the assigned user group, and check whether a Corporate Identifier entry is missing.
• Apps are skipped during provisioning: confirm the apps are correctly assigned and scoped to the device group.
• Device group isn't selectable when creating the policy: make sure the Intune Provisioning Client has been added as an owner of the group.
• Need more detail on a failure: download the diagnostics from the Device Preparation deployment report in Intune.

Final Thoughts

Autopilot Device Preparation isn't a wholesale replacement for classic Autopilot, but for cloud-first organisations deploying Windows 11 with Entra ID, it strips away a lot of the upfront configuration overhead and gives you much better visibility while it runs. Used in the right scenarios, it's a genuinely faster, simpler path to a ready-to-use device.

Ready to simplify your deployments? Let's craft the modern workplace together.