Modern workplace
Windows Autopilot and Intune – new laptops without manual set-up
How Windows Autopilot and Microsoft Intune set up new laptops automatically, what small businesses need, and how to plan the pilot, leavers and older devices.
How Autopilot and Intune work together
Without automation, every new laptop means manual work: setting up Windows, installing software, adjusting settings. It takes time, and each device ends up configured slightly differently.
Microsoft Intune is a cloud service for device management (mobile device management, or MDM). In Intune, you define how your devices must be configured. Windows Autopilot makes sure a new device picks up these settings the first time it starts. The manufacturer's preinstalled Windows is not reimaged but brought into a business-ready state.
Employees simply switch on the device, connect to the network and sign in with their Microsoft 365 account. The device joins Microsoft Entra ID (Entra join), enrols in Intune and receives policies and apps. At best, your IT team never has to touch the device.
Two approaches: classic Autopilot and device preparation
Microsoft offers two variants; they can coexist, but each device goes through only one of them.
With classic Windows Autopilot, each device is registered in advance using its hardware hash, a unique identifier. Ideally, the manufacturer or your reseller does this when you buy. Resellers must be part of Microsoft's CSP programme, and a Global Administrator in your organisation approves the partner relationship; delegated admin permissions are not required. Alternatively, you upload the identifiers yourself as a CSV file.
The newer Windows Autopilot device preparation does without prior registration. At sign-in, the device is added to a predefined device group and immediately receives the apps and scripts selected for it. It requires Windows 11.
| Feature | Classic Autopilot | Device preparation |
|---|---|---|
| Prior registration | yes, by hardware hash | no |
| Join type | Entra join or hybrid join | Entra join only |
| Apps during set-up | up to 100 | up to 25, plus 10 scripts |
| Reset for the next person | Autopilot Reset | not supported |
| Status reporting | delayed | near real time |
Microsoft describes device preparation as simpler to configure and use, while classic Autopilot offers more features and customisation. Which one fits depends on how you buy devices and what you need; Microsoft's comparison of the two approaches lists the differences in detail.
Prerequisites
- Licences: Microsoft 365 Business Premium, E3 and E5 include Intune (Plan 1) and Microsoft Entra ID P1, which automatic enrolment requires. Licences must be assigned to users.
- Windows edition: Windows 11 Pro, Pro Education, Pro for Workstations, Enterprise or Education. Home editions are not among the supported editions.
- Entra join: Microsoft recommends Entra join for new devices rather than hybrid join with an on-premises Active Directory.
- Basic settings: automatic enrolment in Intune is switched on, and you have decided who may join devices to Entra ID.
- Internet: set-up requires an internet connection that does not block Microsoft's services.
What to configure in Intune
Autopilot is only the delivery route; what counts is what you define in Intune. A solid baseline covers:
- Enrolment: an Autopilot profile or a device preparation policy, device names and your company logo on the sign-in page.
- Compliance policies: rules a device must meet, such as active encryption, Secure Boot or a minimum Windows version.
- BitLocker: Intune encrypts the drive silently; the recovery keys are stored in Microsoft Entra ID.
- Updates: update rings in Intune, or Windows Autopatch, which rolls out updates for Windows, Microsoft 365 Apps, Edge and Teams in waves and has been available with Business Premium since 2025.
- Apps: Microsoft 365 Apps, line-of-business software and Microsoft Store apps.
- Microsoft Defender: Business Premium includes Defender for Business, and devices are onboarded through Intune.
- Local administrator rights: employees work as standard users. Windows LAPS manages the local administrator password, rotates it regularly and backs it up to Entra ID.
If you use Conditional Access, set Intune to treat devices without a compliance policy as non-compliant. Our article MFA alone is not enough explains how this works with access rules.
Joiners, leavers and lost devices
New starters receive the device in its original packaging or straight from the reseller, and sign in. To pass on a used device, Autopilot Reset returns it to a business-ready state: personal files, apps and settings are removed, while the connection to Entra ID and Intune remains. This requires classic Autopilot and Entra join.
When someone leaves, Wipe, a reset to factory settings, is usually the right action for company devices. Retire removes only company data and management and leaves personal data in place; it is mainly intended for personal devices. If a device leaves the company for good, for example when sold, also remove it from Autopilot.
If a laptop is lost, trigger a wipe in Intune, if necessary with the option that continues through a power loss. The command only takes effect once the device is online; until then, BitLocker protects the stored data. Also disable the device in Entra ID so that it can no longer access cloud services. Avoid deleting it there early, or you lose the BitLocker keys.
For fiduciary and real-estate firms, a lost device is also a data protection matter. Switzerland's Federal Act on Data Protection requires data security appropriate to the risk (Art. 8 FADP) and a report to the Federal Data Protection and Information Commissioner (FDPIC) if a breach is likely to result in a high risk for the people concerned (Art. 24 FADP). Encryption and a documented procedure help with this assessment but do not replace a case-by-case review.
What happens to existing devices
- Already in Entra ID and Intune: with the profile setting 'Convert all targeted devices to Autopilot', Intune registers these devices retrospectively. Autopilot then applies the next time they are reset.
- Joined to an on-premises domain or through hybrid join: there is no supported path to Entra join without a reset. Microsoft recommends switching at a natural point, such as a hardware replacement.
- Unmanaged, with local accounts: back up the data, reset the device and set it up again through Autopilot.
- Windows 10: support ended on 14 October 2025. Organisations can buy paid Extended Security Updates (ESU) for a maximum of three years. Plan replacements or upgrades to Windows 11 where the hardware allows.
How to get started
- Take stock: devices, Windows editions and versions, licences and how you buy hardware.
- Choose the approach: classic Autopilot with registration by your reseller, or device preparation without prior registration.
- Build the baseline in Intune: enrolment, compliance, BitLocker, updates, Defender, apps and LAPS.
- Test with two or three pilot devices and real users, including one leaver and one simulated loss.
- Document who orders, who registers and who acts when someone leaves or a device goes missing.
- Then set up every new device through Autopilot, and move existing devices at the next natural opportunity.
We set up Autopilot and Intune for SMEs, from licence review and baseline configuration to the pilot. See our pages on the modern workplace and IT security. If you would like to know what this could look like in your environment, get in touch.