Learning Hub

Licensing

Device Requirements

Admin Portals You'll Use

Windows Autopilot lets you ship a brand-new laptop directly to an end user. When they power it on and connect to the internet, the device automatically joins Azure AD, enrolls into Intune, installs apps, and applies all your policies — with no IT intervention needed on-site.

Autopilot Deployment Modes

Before Autopilot can provision a device, it needs to know that device exists in your tenant. This is done by uploading the device's hardware hash — a unique fingerprint of the hardware.

Method 1: Run the Script on the Device

This is the most common method for existing devices or lab testing. Boot the device (or use OOBE Shift+F10 to open a command prompt):

# Install module (requires internet)
Install-Script -Name Get-WindowsAutoPilotInfo -Force

# Capture hash and upload directly to Intune
Get-WindowsAutoPilotInfo -Online

# Save to CSV file instead
Get-WindowsAutoPilotInfo -OutputFile C:\AutopilotHWID.csv

Method 2: Via OEM / Reseller

Most major OEMs (Dell, HP, Lenovo, Microsoft Surface) can register devices into your Autopilot tenant at time of purchase. Give your reseller your Microsoft tenant ID and they'll handle the hash registration before the device ships.

Verify Registration in Intune

After upload, devices appear at: Intune Admin Center > Devices > Windows > Windows Enrollment > Devices. It can take up to 15 minutes to sync.

A Deployment Profile controls the out-of-box experience (OOBE) — what screens the user sees, what the device is named, and how it joins your organisation.

The Enrollment Status Page (ESP) shows the user a progress screen during device setup, preventing them from using the device until all required apps and policies have been applied.

Microsoft Intune is a cloud-based Mobile Device Management (MDM) and Mobile Application Management (MAM) solution. It lets you manage Windows PCs, Macs, iOS and Android devices from a single web portal — no on-premises infrastructure required.

Enable Auto-Enrollment (Required)

Before any device can enroll, you must enable automatic MDM enrollment in Azure AD.

Enrollment Methods

Compliance policies define the minimum security requirements a device must meet to be considered "compliant". Non-compliant devices can be blocked from accessing company resources via Conditional Access.

Configuration profiles push settings to devices. Unlike compliance (which checks settings), configuration profiles actively apply them.

Common Profile Types

Create a Windows Update Ring

App Types in Intune

Packaging a Win32 App

IntuneWinAppUtil.exe -c "C:\Source\MyApp" -s "setup.exe" -o "C:\Output"

# Install command
setup.exe /S /silent

# Uninstall command
"C:\Program Files\MyApp\uninstall.exe" /S

Intune can deploy and run PowerShell scripts on enrolled Windows devices. Scripts run silently in the background — great for configuration tasks that don't have a built-in MDM policy.

Example: Map a Printer via Intune Script

# Deploy via Intune PowerShell Scripts
# Run as: Logged on credentials (user context)

$server  = "printserver01"
$printer = "Secure Print"
$unc     = "\\$server\$printer"

try {
    Add-Printer -ConnectionName $unc -ErrorAction Stop
    Write-Output "Mapped: $unc"
} catch {
    if ($_.Exception.Message -like "*already exists*") {
        Write-Output "Already mapped: $unc"
    } else {
        Write-Error "Failed to map $unc`: $_"
    }
}