Windows Autopilot Device Preparation: A Practical Guide for SMB Admins

What Is Windows Autopilot Device Preparation?

For small and midsize businesses, setting up new Windows devices consistently and securely can be a time-consuming task, especially without a dedicated IT deployment team. Windows Autopilot Device Preparation is a Microsoft Intune-based solution designed to automate much of that setup process for new Windows devices, using the operating system already installed by the OEM (the device manufacturer).

Rather than IT staff manually imaging or configuring a device before it reaches an employee, the device can be shipped directly from the OEM or reseller to the end user. When that user first powers on the device and signs in with their Microsoft Entra credentials during the Windows out-of-box experience (OOBE), the device automatically joins Microsoft Entra ID, enrolls in Intune, and receives a defined set of applications and scripts—without IT needing to physically touch the hardware.

This article explains what Windows Autopilot Device Preparation does, how the enrollment process works, what an SMB needs in place before using it, and how it compares to the broader concept of Windows Autopilot deployment profiles.

How Device Preparation Differs From Traditional Autopilot Profiles

It’s worth noting upfront that Windows Autopilot Device Preparation is a distinct capability within the broader Windows Autopilot family, focused specifically on a user-driven Microsoft Entra join scenario. According to Microsoft’s documentation, the process is built around a defined, limited set of actions performed automatically during setup:

• Joining the device to Microsoft Entra ID
• Enrolling the device in Intune
• Installing up to 25 essential applications
• Running up to 10 essential PowerShell scripts

The supplied Microsoft source material describes this specific workflow in detail but does not provide a side-by-side technical comparison against traditional Autopilot deployment profiles. SMB admins evaluating both approaches should treat Device Preparation as a distinct, user-driven Entra-join workflow with its own requirements and behavior, rather than assuming feature parity with other Autopilot deployment methods.

What Happens During Enrollment: The Step-by-Step Process

Microsoft documents a specific sequence of events that occurs when a user sets up a device with Windows Autopilot Device Preparation policy assigned to them:

1. Authentication during OOBE. The user signs in with corporate Microsoft Entra credentials. If a Device Preparation policy is assigned to that user, it’s delivered to the device.
2. Entra join and Intune enrollment. The device joins Microsoft Entra ID and enrolls in Intune.
3. Intune management extension installs, enabling later app and script delivery.
4. Local administrator handling. During Microsoft Entra join, the signed-in user is initially added to the local Administrators group. If the Device Preparation policy sets the user account type to Standard User, the deployment removes that user from the Administrators group before setup completes.
5. Sync and required app/script check. The device syncs with Intune to determine whether line-of-business (LOB) or Microsoft 365 apps are selected in the policy. If any required LOB or Microsoft 365 app fails to install, the deployment fails at this stage.
6. Required PowerShell scripts run. If a required script fails, the deployment fails at this point too.
7. Required Win32, Microsoft Store, or Enterprise App Catalog apps install. A failure here also halts the deployment.
8. Required setup complete page displays, assuming all previous steps succeeded.
9. Automatic sign-in to the desktop once the user dismisses that page.
10. Additional sync occurs after desktop sign-in, delivering any apps, scripts, or MDM policy assigned to the device group but not explicitly marked as required, along with user-based configurations.

This means the “required setup complete” screen the user sees represents only the essential, policy-defined configuration—additional software and settings can continue to arrive in the background after the user is already working on the device.

Prerequisites SMBs Need Before Using Device Preparation

Microsoft organizes the requirements for Windows Autopilot Device Preparation into five categories: software, networking, licensing, configuration, and role-based access control (RBAC). Each is worth understanding before planning a rollout.

Software Requirements

Windows Autopilot Device Preparation requires a supported Windows 11 release that meets Microsoft’s minimum build and update requirements. At the time of writing, Microsoft documents support for Windows 11 24H2 or later, plus Windows 11 23H2 and 22H2 when the required servicing update is present.

Supported editions include Windows 11 Pro, Pro Education, Pro for Workstations, Enterprise, Education, and Enterprise LTSC. Because these minimum-version requirements can change, verify the current Windows Autopilot Device Preparation requirements before purchasing or deploying devices.

Networking Requirements

Because the entire process depends on cloud services, devices need reliable internet access during setup. At minimum, this means DNS resolution for internet names and access over ports 80 (HTTP), 443 (HTTPS), and 123 (UDP/NTP). Microsoft’s documentation lists a number of specific services the device contacts during setup, including the Windows Autopilot deployment service, Windows activation, Microsoft Entra ID, Intune, Windows Update, and Delivery Optimization. Some of these dependencies are not strictly required for the process to complete—for example, if Windows Update or the Microsoft Store are inaccessible, deployment continues but without those specific benefits (such as critical updates or Store apps).

Practical recommendation: SMBs with restrictive firewalls, guest Wi-Fi networks, or captive portal authentication should review their network configuration in advance and test a device deployment before rolling this out broadly, since restrictive network environments may require additional configuration.

Licensing Requirements

To get the necessary Microsoft Entra ID and Intune (MDM) functionality, including automatic enrollment and company branding features, Microsoft states that one of the following is required:

• Microsoft 365 Business Premium
• Microsoft 365 F1 or F3
• Microsoft 365 Academic A1, A3, or A5
• Microsoft 365 Enterprise E3 or E5
• Enterprise Mobility + Security E3 or E5
• Intune for Education
• Microsoft Entra ID P1 or P2 combined with an Intune subscription (or an alternative MDM service)

For most SMBs already using Microsoft 365 Business Premium, this requirement is typically already satisfied. However, Microsoft notes that even with a qualifying subscription, licenses still need to be individually assigned to users so they can enroll devices in Intune—simply having the tenant-level subscription is not sufficient on its own.

Microsoft 365 Apps for enterprise and Windows Subscription Activation (which can step devices up from Windows Pro to Enterprise) are noted as recommended but not required.

Configuration Requirements

Before deployment, Microsoft documentation specifies two required configuration tasks:

• Configuring Microsoft Entra automatic enrollment for Intune (or the equivalent setup for another MDM provider)
• Ensuring the first user who signs in has Microsoft Entra join permissions

Stepping devices up from Windows Pro to Enterprise via Windows Subscription Activation is listed as optional but recommended. Microsoft also notes there are no additional hardware requirements beyond those needed to run Windows 11 itself.

RBAC (Role-Based Access Control) Requirements

Administering Windows Autopilot Device Preparation requires a specific set of Intune RBAC permissions. According to Microsoft’s documentation, the role used for this work needs:

• Device configurations: Read, Delete, Assign, Create, Update
• Enrollment programs: Enrollment time device membership assignment
• Managed apps: Read
• Mobile apps: Read
• Organization: Read

Microsoft documents how to create a custom Intune role containing these permissions through Tenant administration > Roles. A custom role is therefore one practical least-privilege option; the key requirement is that the administrator has the documented permissions needed for the Device Preparation tasks they perform.

Setting Up the Workflow

Microsoft’s tutorial describes a workflow of six required configuration steps for any Windows Autopilot Device Preparation user-driven Entra join deployment:

1. Set up Windows automatic Intune enrollment
2. Allow users to join devices to Microsoft Entra ID
3. Create an assigned device group
4. Create a user group
5. Assign applications and PowerShell scripts to the device group
6. Create the Windows Autopilot Device Preparation policy

There is also an optional seventh step for organizations that use Intune enrollment restrictions to block personal devices. In that case, admins need to configure either a corporate device identifier or device association (not both) before deployment, so that only trusted devices are onboarded. Microsoft notes that device association also unlocks additional policy settings, such as OOBE customization and device naming, that are only available to associated devices.

When Should an SMB Consider Using Device Preparation?

The supplied Microsoft documentation does not make specific recommendations about which businesses should or shouldn’t adopt Windows Autopilot Device Preparation. However, based on the documented capabilities, a few practical scenarios stand out where this approach may be worth evaluating:

• New employee onboarding with shipped devices. If your business regularly ships new laptops directly from a reseller or OEM to remote or hybrid employees, Device Preparation’s user-driven setup can reduce the need for IT to physically image devices beforehand.
• Standardizing app and script deployment. Businesses that want a consistent, minimal set of required apps and scripts installed before a user reaches the desktop may benefit from the required-app and required-script model described above.
• Environments already using Intune. Since Device Preparation depends on Microsoft Entra ID and Intune enrollment, organizations already managing devices through Intune are better positioned to adopt it without additional infrastructure changes.

Practical recommendation: Before rolling this out organization-wide, test the full workflow—including network access, licensing assignment, and the RBAC role—with a small pilot group of devices. This is a practical suggestion, not a documented Microsoft requirement, but it can help surface network or licensing gaps before they affect real end users.

Conclusion

Windows Autopilot Device Preparation gives SMB administrators a documented, structured way to automate the initial setup of new Windows 11 devices, joining them to Microsoft Entra ID, enrolling them in Intune, and installing a defined set of required apps and scripts, all with minimal action required from the end user. Getting it right depends on meeting Microsoft’s software, networking, licensing, configuration, and RBAC requirements before deployment. For SMBs already invested in Microsoft 365 and Intune, understanding these prerequisites and the step-by-step enrollment process is the necessary first step before deciding whether this approach fits your device deployment needs. As with any new deployment method, plan for a pilot phase and review the official Microsoft documentation for the most current requirements before rolling it out broadly.