---
title: "Windows Autopilot - Enrolling a Device in Microsoft Intune"
slug: "windows-autopilot-enrolling-a-device-in-microsoft-intune"
description: "How to enroll a device in Microsoft Intune with Windows Autopilot and RapidIdentity."
tags: ["Microsoft", "Intune", "Autopilot", "Device Enrollment Manager", "RapidIdentity "]
updated: 2022-08-01T17:40:53Z
published: 2022-08-01T17:40:53Z
canonical: "help.rapididentity.com/windows-autopilot-enrolling-a-device-in-microsoft-intune"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://help.rapididentity.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Windows Autopilot - Enrolling a Device in Microsoft Intune

## Windows Autopilot-Enrolling a device in Microsoft Intune

1. [Prerequisites](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#prerequisites)
2. [Microsoft Intune Subscription Level Verification](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#microsoft-intune-subscription-level-verification)
3. [Configure Microsoft Intune auto-enrollment](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#configure-microsoft-intune-autoenrollment)
4. [Capture Client Workstation Hardware ID](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#capture-client-workstation-hardware-id)
5. [Reset workstation back to Out-of-the-box-Experience(OOBE)](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#reset-client-workstation-back-to-outofboxexperience-oobe)
6. [Client workstation registration with Microsoft Intune](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#client-workstation-registration-via-microsoft-intune)
7. [Create and assign a Windows Autopilot deployment profile](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#create-and-assign-a-windows-autopilot-deployment-profile)
8. [Create the deployment profile](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#create-the-deployment-profile)
9. [How to Create a New User](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#how-to-create-a-new-user)
10. [Assign licenses to users so they can enroll devices in Intune](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#assign-licenses-to-users-so-they-can-enroll-devices-in-intune)
11. [Windows Autopilot OOBE experience on Client Workstation](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#windows-autopilot-oobe-experience-on-client-workstation)
12. [Remove devices from Autopilot](/v1/docs/windows-autopilot-enrolling-a-device-in-microsoft-intune#remove-devices-from-autopilot)

### **Prerequisites**

You'll need the following components to enroll a device:

| **Windows 10 installation media** | Windows 10 1703 and above versions. Professional or Enterprise ISO file for a supported version of Windows 10 on your device or on your VMware |
| --- | --- |
| **Internet access** | Make sure that you have a connection to the internet. |
| **An account with Azure Active Directory (Azure AD) Premium license** | This guide will describe how to get a free 30-day trial Azure AD Premium subscription that can be used to complete the lab. |

### **Microsoft Intune Subscription Level Verification**

For this enrollment, you need an Azure AD Premium subscription. To verify if you have a Premium subscription, go to **MDM enrollment configuration** at [https://portal.azure.com/#home](https://portal.azure.com/#home). See the following example:

**Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune**

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-y7imrcx9.png)

If this configuration doesn't appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in Azure AD Premium.

To convert your Intune trial account to a free Premium trial account, go to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-zkal0sys.png)

### **Configure Microsoft Intune Auto-Enrollment**

If you already have MDM auto-enrollment configured in Azure AD, you can skip this step.

Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you don't see Microsoft Intune, select **Add application** and choose **Intune**.

Select **All** under the **MDM user scope** and select **Save**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-5kqbouad.png)

### **Capture Client Workstation Hardware ID**

Follow these steps to capture the Client workstation hardware ID.

1. **On Client workstation**: Open an elevated Windows PowerShell prompt and run the following commands.
2. **New-Item** -Type Directory -Path "C:\HWID"
3. **Set** - Location C:\HWID
4. **Set** - ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
5. **Install** - Script -Name Get-WindowsAutopilotInfo -Force
6. **$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"**
7. **Get** - WindowsAutopilotInfo -OutputFile AutopilotHWID.csv
8. When you're prompted to install the NuGet package, choose **Yes**.
9. Navigate to **C:\HWID** directory to find **AutopilotHWID.csv.** This file contains the complete Hardware ID(4K Hardware Hash).

You'll need to upload this data into Intune to register your device for Autopilot. Save this file to the workstation you'll use to access the Azure portal.

- If you're using a physical device instead of a VM, you can copy the file to a USB drive.
- If you're using a VM, you can right-click the **AutopilotHWID.csv** file and copy it. Then right-click and paste the file to your desktop (outside the VM).

### **Reset Client Workstation back to Out-Of-Box-Experience (OOBE)**

With the hardware ID captured in a file, prepare your Client workstation for Windows Autopilot deployment by resetting it back to OOBE.

1. On the Client workstation, navigate to **Settings > Update & Security > Recovery.**
2. Click **Get started** under **Reset this PC**.
3. Click **Remove everything**.
4. You will now be presented with an option asking how you would like to reinstall Windows 10. At this screen, click on the '**Local reinstall**' option.
5. You will now be asked to confirm your selection. Please review the selected options and click on the **Next** button.
6. You will now be shown a final screen asking you to confirm your final selections. When ready, click on the **Reset** button.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-k7vs1ztp.png)

Resetting the device can take a while.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-nf1rbmt6.png)

## **Client Workstation Registration via Microsoft Intune**

Follow these steps to register your Client Workstation via Intune.

1. In [https://endpoint.microsoft.com/#home](https://endpoint.microsoft.com/#home), navigate to **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices**![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-fck01is9.png)
2. On the **Windows Autopilot devices** page, click **Import**.![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-7ygix993.png)
3. Under **Add Windows Autopilot devices**, browse to the **AutopilotHWID.csv** file saved from step 4 that lists the devices that you want to add. The file should contain the serial number and 4K HH of your workstation. It's okay if other fields (Windows Product ID) are left blank.  
![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-fbozl0rm.png)
4. Select **Import** to start importing the device information. Importing can take several minutes.
5. Click **Refresh** to verify your Client workstation is added.  
![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-eqnkeoue.png)

### **Create and assign a Windows Autopilot deployment profile**

1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), Select **Groups** > **New Group**.
2. In the **New Group** pane:
  1. For **Group type**, choose **Security**.
  2. Type a **Group name** and **Group description** (ex: Autopilot Lab).
  3. Azure AD roles can be assigned to the group: **No**
  4. For **Membership type**, choose **Assigned**.
3. Search device name which is registered in Step 6 and add to this group. See below for reference

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-dav789ac.png)

1. Click **Create**.

### **Create the deployment profile**

1. Select **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-zz6jsxcg.png)

1. Select **Create profile** > **Windows PC**

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-2kf6bqjo.png)

1. On the **Create profile** pane, use the following values:

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-yoi2gyuk.png)

1. Click **Next** to continue with the **Out-of-box experience (OOBE)** settings:

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-x9zhi5fs.png)

1. Click **Next** to continue with the **Assignments** settings:

- Click **Add Groups**
- Select the **Autopilot Lab** group, and then click **Select**.
- Click **Next** to continue, and then click **Create**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-xk6etcxg.png)

- Select **OK**, and then select **Create**.

### How to Create a New User

1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Users** > **All users** > **New user** > **Create user**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-t2sn9bjo.png)

1. Specify the following user details:
  - **Username** - The new name that the user will use to sign in to Azure Active Directory.
  - **Name** - The user's given name.
2. Choose whether you want to create the password for the new user or have it autogenerated.
3. To assign the new user to groups (optional), choose **0 groups selected** to open the **Groups** pane. Here you can select the groups you want to assign to the user. When finished selecting groups, choose **Select**.
4. By default, the new user is assigned the role of **User**. If you want to add roles to the user, select **User** under **Groups and roles**. In the **Directory roles** pane, select the roles you want to assign to the user and then choose **Select**.
5. If you want to block the user from signing in, you can select **Yes** for **Block sign in**. Make sure to switch this back to **No** when you're ready to let the user sign in.
6. Choose a **Usage location** for the new user. Usage location is required before you can assign the new user an Intune license.
7. Optionally, you can provide information for the **Job title**, **Department**, **Company name**, and **Manager** fields.
8. Select **Create** to add the new user to Intune.

### **Assign licenses to users so they can enroll devices in Intune**

Whether you manually add users or synchronize from your on-premises Active Directory, you must first assign each user an Intune license before users can enroll their devices in Intune.

You can use the [Microsoft Admin](https://admin.microsoft.com/) to manually add cloud-based users and assign licenses to both cloud-based user accounts and accounts synchronized from your on-premises Active Directory to Azure AD.

1. In the [Microsoft Admin](https://admin.microsoft.com/), select **Users** > **All Users** > choose a user > **Licenses** > **Assignments**.
2. Choose the box for **Intune and Enterprise Mobility + Security E5** > **Save**.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-787ozko7.png)

1. The user account now has the permissions needed to use the service and enroll devices into management.

### Windows Autopilot **OOBE experience on Client Workstation**

Restart the client workstation if you have shut it down after the last reset. It will then go through the Autopilot OOBE experience. However, don't attempt to start your device again until the **PROFILE STATUS** for your device in Intune is changed from **Not assigned** to **Assigning**, and finally to **Assigned**:

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-nvjfeap5.png)

If you reset your device previously, after collecting the 4K HH info, let it restart back to the first OOBE screen. Then you might need to restart the device again to make sure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you don't see the Autopilot OOBE experience, then reset the device again (**Settings** > **Update & Security** > **Recovery** and select **Get started**. Under **Reset this PC**, select **Remove everything and Just remove my files**. Select **Reset**).

1. Make sure your device has an internet connection.
2. Turn on the device.
3. Verify that the appropriate OOBE screens appear. Provide your user credentials created in Step 9. Then you're all done.

After the device loads the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go to the Intune portal, and select **Devices > All devices**. Then **Refresh** the data to verify that your device has changed to an enabled state, and the name of the device is updated.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-y2vzpkgu.png)

Windows Autopilot automatically join your device into Azure AD and enroll it into Microsoft Intune.

### **Remove devices from Autopilot**

If you need to remove (deregister) it from Autopilot via either Intune and then reset it. Instructions for deregistering devices can be found in below steps.

#### Delete (deregister) Autopilot device

You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure AD), log into the Microsoft Endpoint Manager admin center, then go to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-kalzgseo.png)

This action removes the device from Intune management and it will disappear from **Intune > Devices > All devices**. But this action doesn't yet deregister the device from Autopilot. So, the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**.

The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two separate datastores. The former (All devices) is the list of devices currently enrolled into Intune.

A device only appears in the **All devices** list once it has booted. The latter (**Windows Autopilot Deployment Program** > **Devices**) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.

To remove the device from the Autopilot program, select the device, and then select **Delete**. A pop-up dialog box appears to confirm deletion.

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-l2arzl6j.png)

At this point, your device is unenrolled from Intune and also deregistered from Autopilot. After several minutes, select the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program.

Once the device no longer appears, you're free to reuse it for other purposes.

If you also (optionally) want to remove your device from Azure AD, go to **Azure Active Directory > Devices > All Devices**, select your device, and then select the **Delete** button:

![](https://cdn.document360.io/4d958006-b877-42af-8de5-00e3bb7fe41d/Images/Documentation/windows-autopilot---enrolling-a-device-in-microsoft-intune-image-mj8c0jfp.png)

[How to deploy an MSI package to an enrolled device through Microsoft Intune](/v1/docs/deployment-of-msi-packages-through-microsoft-intune)

## Related

- [Deploy MSI Installer for Windows Authentication with Windows Group Policy Object (GPO)](/deploy-msi-installer-for-windows-authentication-with-windows-group-policy-object-gpo.md)
- [Deployment of MSI packages through Microsoft Intune](/deployment-of-msi-packages-through-microsoft-intune.md)