Intune Autopilot: deploying PCs without touching them

Setting up a computer by hand takes time: installing Windows, the apps, the security settings, the printer. With Intune Autopilot, the device ships directly from the reseller to the employee and configures itself at first sign-in with their work account.

For a small business, that saves time with every new hire and every replacement, and above all it means every computer is configured the same way. Here is how Intune Autopilot works, what it lets you manage and which licenses it requires.

How does Intune Autopilot work?

The exact name is Windows Autopilot: it is the Microsoft service that ties a new device to your company, and Intune is the tool that manages it afterwards. The manufacturer or reseller registers each machine's hardware ID in your tenant when the order is placed. Devices already in use can also be registered later.

When the employee turns on the device and signs in with their Microsoft 365 account, Windows recognizes that it belongs to the company, joins it to Entra ID and applies the planned configuration. An Internet connection is enough: there is no need to be in the office.

Autopilot profiles: which deployment mode to choose?

The Autopilot profile describes how the device behaves at first startup: language and keyboard, hidden setup screens, device name based on a rule, local administrator rights granted to the user or not. Three modes cover most needs.

• User-driven mode: the usual case, the device is associated with the person who signs in.
• Self-deploying mode: for a shared device or a kiosk, with no assigned user.
• Pre-provisioning: the reseller or IT team installs the heavy apps in advance, and the user finishes setup faster.

What Intune manages after deployment

• Compliance: the device must be encrypted, up to date and protected; otherwise, Conditional Access can deny it access to company data.
• Encryption: BitLocker turned on automatically, with the recovery key stored in Entra ID rather than on a piece of paper.
• Apps: Microsoft 365, the browser and business software installed from Intune, without a trip to the office.
• Windows updates: rolled out in waves, with a delay to test before going wide.
• Remote wipe: a lost or stolen device can be reset or wiped from the console as soon as it reconnects to the Internet.

Intune Autopilot: which licenses and prerequisites?

Intune and Entra ID P1, which is needed for automatic device enrollment, are included in Microsoft 365 Business Premium. They are also part of other plans, for example Microsoft 365 E3 and E5, or available as separate licenses. Business Basic and Business Standard do not include Intune.

On the device side, you need Windows 11 Pro, Enterprise or Education: the Home edition is not supported. Computers bought from consumer retail stores often ship with Windows Home and must be upgraded. Finally, the reseller must be authorized to register devices in your tenant, which needs to be set up before the first order.

Where to start with Autopilot?

Start with one or two pilot devices: prepare the profile, the compliance rules and the app list, then test a complete installation in real conditions, from the box to the first document opened. Fix whatever is missing before rolling out further.

Existing computers can join Intune gradually, as they are replaced. Document the chosen configuration: it is what guarantees that the tenth device will be identical to the first.