Part 1: Windows Autopilot Prerequisites in Intune: Licences, Automatic Enrolment and Branding

#What this part sets up

This series takes a Microsoft 365The KBY LexiconMicrosoft 365Microsoft 365 defined at plain and technical depth, with architecture, operational relevance, an example and a common misunderstanding for practitioners. Read Full Context tenant from no Windows AutopilotThe KBY LexiconWindows AutopilotWindows Autopilot registers device hardware identity to a tenant so new or reset Windows devices self-configure via Entra ID join and Intune policy during first boot. Read Full Context configuration to a working box-to-desktop deployment, then shows how to reset and retire devices safely. Each part ends with a check you can see in an admin centre, so you never build on a step that did not take effect.

This first part touches no devices. It prepares the tenant so that, when a new laptop reaches the Windows out-of-box experience (OOBE), Windows can authenticate the user, join the device to Microsoft Entra IDThe KBY LexiconMicrosoft Entra IDA concise technical definition of Microsoft Entra ID: what it is, how it fits identity architecture, and where engineers must validate before change. Read Full Context and enrol it in Microsoft Intune automatically. By the end you will have confirmed the licences, scoped automatic enrolment to a pilot group, checked who may join devices to Microsoft Entra ID, decided whether to add company branding, and chosen between classic Windows Autopilot and Windows Autopilot device preparation.

The series makes three assumptions throughout, and later parts rely on them:

• Devices are cloud-native and use Microsoft Entra join. Microsoft recommends Entra join for new devices and does not recommend deploying new devices as Microsoft Entra hybrid joined, including through Autopilot.
• Deployments are user-driven: the person who will use the laptop signs in during OOBE.
• Work starts with a pilot security group, called SG-Autopilot-Pilot in this series, containing a few test users. Widen the scope only after the pilot has passed every check.

#Before you start

You need these admin roles, or someone who holds them:

• Global Administrator in Microsoft Entra ID, to change the Windows automatic enrolment settings in the Intune admin centre. This is the role Microsoft’s procedure lists for that page.
• Cloud Device Administrator, to change Microsoft Entra device settings. Intune Administrator can read those settings but not change them.
• Organizational Branding Administrator, the minimum role for company branding.

Devices must run a supported edition of Windows 11 or Windows 10: Pro, Pro Education, Pro for Workstations, Enterprise, Education or Enterprise LTSC. Windows Home is not on the list. Network access matters too, because Autopilot depends on internet services such as the Windows Autopilot Deployment Service, Microsoft Entra ID, Intune and Windows activation. Microsoft’s requirements page lists the hosts. In the simplest case, devices need DNS resolution for internet names and access to all hosts on ports 80 (HTTP), 443 (HTTPS) and 123 (UDP, for time synchronisation); networks that restrict internet access or require authentication before it need more configuration.

Before changing anything, write down the current value of each setting this part touches: the MDM user scope, the WIP user scope, and the “Users may join devices to Microsoft Entra ID” setting. Those notes are your way back if a change has an effect you did not expect.

#Step 1: Confirm the licences

Autopilot needs Microsoft Entra ID features (automatic MDM enrolment and company branding) and an MDM service. Microsoft lists these subscriptions as providing what Autopilot needs:

• Microsoft 365 Business Premium
• Microsoft 365 F1 or F3
• Microsoft 365 Academic A1, A3 or A5
• Microsoft 365 Enterprise E3 or E5
• Enterprise Mobility + Security E3 or E5
• Intune for Education
• Microsoft Entra ID P1 or P2 together with a Microsoft Intune subscription

Owning the subscription is not enough. Microsoft notes that with a Microsoft 365 subscription, licences must still be assigned to users so they can enrol devices in Intune. Assign a licence that includes Intune and Entra ID P1 to every member of SG-Autopilot-Pilot, either directly or through group-based licensing.

Check it worked: open one pilot user in the Microsoft 365 admin centre, go to their licences and apps, and confirm that the assigned licence includes Microsoft Intune and Microsoft Entra ID P1 (or P2) among its apps, both turned on.

#Step 2: Scope automatic enrolment to the pilot group

Automatic enrolment is what turns “this device joined Microsoft Entra ID” into “this device is now managed by Intune”. Without it, the device joins but is not enrolled, and the steps in later parts cannot apply.

1. Sign in to the Microsoft Intune admin centre.
2. Go to Devices, expand Device onboarding and select Enrollment.
3. Select the Windows tab, then Automatic Enrollment.
4. Set MDM user scope to Some and select SG-Autopilot-Pilot. (All enrols every user’s devices; None turns automatic enrolment off.)
5. Set WIP user scope to None. If it must stay at another value, make sure the pilot users are not in both scopes.
6. Leave the MDM terms of use, discovery and compliance URLs at their default values, and save.

If the settings are not visible, Microsoft’s note applies: automatic MDM enrolment is a Microsoft Entra ID premium feature, so the tenant needs an Entra ID P1 or P2 subscription.

Check it worked: reopen Automatic Enrollment and confirm that MDM user scope shows Some with SG-Autopilot-Pilot selected and WIP user scope shows None. If the change causes problems for existing users, set both scopes back to the values you recorded before you started.

#Step 3: Check who may join devices to Microsoft Entra ID

In a user-driven deployment, the first user who signs in during OOBE joins the device to Microsoft Entra ID. That user must be allowed to join devices. Self-deploying mode is the exception, because it runs without a user.

1. Sign in to the Microsoft Entra admin centre as a Cloud Device Administrator.
2. Browse to Entra ID > Devices > All devices > Device settings.
3. Find Users may join devices to Microsoft Entra ID. The default is All. If your tenant uses Selected, add SG-Autopilot-Pilot to the selection rather than switching the setting to All.
4. Note Maximum number of devices per user. A pilot user who reaches the limit cannot join another device until one is removed, which is easy to hit when the same test user redeploys laptops repeatedly.

Check it worked: the setting shows All, or Selected with the pilot group included, and the device limit leaves room for repeated test deployments.

#Step 4: Decide on company branding

Microsoft lists company branding as optional but recommended for Autopilot. With it, the sign-in page during OOBE shows your organisation’s logo and text, which tells users they are signing in to the right place. Without it, they see the default Microsoft sign-in page and the deployment still works.

The elements Microsoft calls out for Autopilot are the square logo, the sign-in page text and the tenant name. To set the first two, sign in to the Microsoft Entra admin centre as an Organizational Branding Administrator and browse to Entra ID > Custom Branding. The sign-in page text appears on a public page, so use it for something like the service desk phone number, never for anything sensitive. The tenant name is set separately, in the tenant’s properties.

Check it worked: open a private browser window, start a sign-in with a pilot user’s address, and confirm the logo and text appear after the username is entered.

#Step 5: Choose classic Autopilot or Autopilot device preparation

Microsoft now offers two solutions, and the choice affects every later part. They can run side by side in one organisation, but any one device can only run one of them. For a device registered with classic Windows Autopilot, Microsoft states that if the device is not associated with the tenant, the classic Autopilot profile takes precedence.

This series uses classic Windows Autopilot. It supports Windows 10 devices still in the fleet, its Enrollment Status Page can hold users until required apps and user-based configuration are in place (Part 4), and it supports Autopilot Reset for reusing devices (Part 6). Device preparation is a sound choice for a Windows 11-only fleet that values simpler setup over those features, but it is not what the rest of this series teaches.

#If a check fails

#Ready for Part 2: registering the first pilot device

At this point the tenant is prepared, with nothing yet changed on any device:

• Pilot users hold licences that include Intune and Microsoft Entra ID P1.
• Automatic enrolment is scoped to SG-Autopilot-Pilot, with the previous values recorded.
• Pilot users are allowed to join devices to Microsoft Entra ID, with room under the device limit.
• Branding is either configured or knowingly left at the default.
• Classic Windows Autopilot is the chosen solution, so devices must be registered before they can deploy.

Part 2 depends on that last decision. It registers one pilot device in Windows Autopilot by importing its hardware hash into Intune, sets a group tag at the same time, and explains why the Microsoft Entra device object that registration creates should not be deleted by hand.

#Related reading