Everything You Need to Know About Windows Autopilot Deployment in 2026: Prerequisites and Setup

Windows Autopilot is still one of the cleanest ways to provision business PCs, but the setup guidance has changed since the Azure AD and Windows 10 era. In 2026, a working Autopilot deployment depends on Microsoft Intune, Microsoft Entra ID, Windows 11, the right licenses, and security policies that are ready before the first device is unboxed. This guide covers the prerequisites, the setup steps, the deployment modes, the reset-versus-wipe decision and the rollout order.

What Windows Autopilot does today

Windows Autopilot helps organizations deploy, reset, repurpose, and retire Windows devices with less manual imaging work. Instead of building and maintaining traditional OS images, IT registers the device, assigns deployment and management settings, and lets the user or IT technician complete setup through the Windows out-of-box experience.

The core flow is still straightforward:

1. Register the device with the Windows Autopilot service. This can be done by an OEM, reseller, cloud solution provider, IT partner, or your internal IT team by importing the device hardware hash.
2. Assign the device to the right Autopilot profile and Microsoft Entra group. Microsoft Intune applies the deployment profile, apps, configuration profiles, compliance policies, and security baselines.
3. Deploy the device. The user signs in with a work account, or IT pre-provisions the device before shipping it to the user, depending on the scenario.

The ecosystem now centers on the Microsoft Intune admin center and the Microsoft Entra admin center, not the legacy Azure AD portal, and not Microsoft Store for Business: Microsoft Learn notes its retirement is postponed and its tab left the Microsoft Store app in April 2023, so do not build a new Autopilot process on it.

2026 prerequisites checklist

Before deploying Windows Autopilot, confirm these requirements:

• Supported Windows edition: Windows 11 Pro, Windows 11 Enterprise, or Windows 11 Education. Windows Home is not suitable for business Autopilot enrollment. Support for Windows 10 ended on 14 October 2025; it belongs in scope only for devices on Extended Security Updates (see our Windows 10 ESU article).
• Microsoft Intune: users or devices need Intune licensing, commonly through Intune Plan 1, Microsoft 365 Business Premium, Microsoft 365 E3/E5, Enterprise Mobility + Security, or eligible Frontline plans.
• Microsoft Entra ID: automatic MDM enrollment and Conditional Access need Microsoft Entra ID P1 or a suite that includes it, such as Microsoft 365 Business Premium or Microsoft 365 E3/E5; Microsoft Learn's Conditional Access documentation names Business Premium alongside Entra ID P1.
• Device identity: Autopilot commonly uses Microsoft Entra join for cloud-native deployments. Hybrid Microsoft Entra join is still possible, but it adds complexity and should only be used when there is a clear technical dependency.
• Network access: devices must reach Microsoft cloud endpoints during the out-of-box experience. Restrictive proxy, SSL inspection, captive portal, or firewall configurations can break provisioning.
• Hardware readiness: devices should meet Windows 11 hardware requirements, including TPM 2.0, Secure Boot, and UEFI. Self-deploying and pre-provisioned scenarios have additional TPM attestation requirements.
• Device registration process: decide whether devices will be registered by your OEM, reseller or IT partner, through Partner Center, or manually in Intune.
• User readiness: users must be allowed to join devices to Microsoft Entra ID and enroll devices in Intune unless you use a scenario that avoids user-driven enrollment.

Microsoft list price, October 2026 price list, annual term: Intune Plan 1 $96.00 per user per year ($8.00 per month), Entra ID P1 $84.00 ($7.00), Business Premium $264.00 ($22.00) with both included, Microsoft 365 E3 $468.00 ($39.00) with both plus Windows Enterprise; our Intune licensing article covers the add-ons.

Choose the right Autopilot scenario

Autopilot is not a single deployment mode. The right option depends on who touches the device and how much setup must happen before the user receives it.

• User-driven Microsoft Entra join: the most common cloud-first scenario. The user signs in during setup, the device joins Microsoft Entra ID, enrolls in Intune, and receives assigned apps and policies.
• Pre-provisioned deployment (formerly white glove): IT, a reseller, or a partner prepares the device before delivery. The user receives a device that already has many required apps and policies installed, reducing first sign-in time.
• Self-deploying mode: used for kiosks, shared devices, and digital signage where no primary user signs in. It needs a physical TPM 2.0 chip and successful attestation (virtual machines are not a reliable target), works best on wired Ethernet, and needs device-targeted apps and policies.
• Autopilot Reset: returns a managed device to a business-ready state while preserving its Microsoft Entra join and Intune enrollment, useful for reassignment or troubleshooting.
• Autopilot for existing devices: reprovisions a Windows device that was never registered, often during a refresh or an on-premises-to-cloud migration.
• Windows Autopilot device preparation: the newer Intune experience for cloud-native, user-driven Windows 11 deployments, documented by Microsoft separately from classic Autopilot.

Decision rule: use device preparation for a new, straightforward Windows 11 user-driven process; keep classic profiles for self-deploying, kiosk and shared devices, pre-provisioning, hybrid join, or a procurement process built on OEM registration and group tags.

Reset, Wipe, Fresh Start, Retire, or Delete

Picking the wrong Intune action leaves data behind, orphans the device record, or makes the device harder to redeploy. Define one standard lifecycle action per situation:

Action	What it does	Use it when
Autopilot Reset	Removes user data, apps and settings; keeps Microsoft Entra join and Intune enrollment	The device stays in the organization and goes to the next user
Wipe	Resets the device fully and can return it to the out-of-box experience	You need a deeper reset or the ownership state changes
Fresh Start	Reinstalls Windows and removes preinstalled manufacturer apps	The goal is a clean Windows installation rather than reassignment
Retire	Removes company data and management but does not reset the operating system	Personally owned or BYOD-style devices leaving management
Delete	Removes the device record from Intune without touching the physical device	Cleaning up records for devices already gone

Trigger Autopilot Reset remotely from the Intune admin center for auditability rather than enabling local reset from the lock screen.

One-time setup: Microsoft Intune and Microsoft Entra ID

Use the current admin centers rather than the old Azure portal instructions.

1. Configure automatic MDM enrollment

• In the Microsoft Entra admin center, configure Mobility (MDM and MAM) settings for Microsoft Intune.
• Set the MDM user scope to All or to a controlled group for pilot rollout.
• Confirm that users in scope have Intune and Microsoft Entra ID licensing.

2. Configure Microsoft Entra company branding

• Configure company branding so users recognize the sign-in experience during Windows setup.
• Use the current logo, background, privacy, and support text.
• Clear branding helps users trust the sign-in prompt and reduces help desk confusion.

3. Allow the right users to join devices

• In Microsoft Entra ID device settings, confirm which users may join devices to Microsoft Entra ID.
• Avoid allowing more users than necessary if your governance model requires tighter control.
• Review device limits per user so legitimate deployments do not fail unexpectedly.

4. Register devices and automate grouping

• Have the OEM, reseller or CSP partner register devices to your tenant through Partner Center or an approved OEM workflow, add a group tag, and ship straight to the employee. Hardware-hash import in Intune is for pilots and repurposed devices, not for scale.
• Build Microsoft Entra dynamic device groups so profile assignment is automatic: one for all Autopilot devices (keyed on the Autopilot device attribute, ZTDId) and groups keyed on group tag or purchase order for departments, kiosks and pilots.
• Dynamic group evaluation and profile assignment are not instant, so register and tag devices before they ship.

5. Create Autopilot deployment profiles

• In the Microsoft Intune admin center, go to Devices > Windows > Windows enrollment > Deployment Profiles (Microsoft moves labels occasionally; searching for Windows enrollment finds it).
• Create profiles that match your scenarios: user-driven, pre-provisioned, or self-deploying where supported, and set join type, device naming template, hidden out-of-box pages and whether the user becomes a local administrator (standard user is the default to keep).
• Assign profiles to the dynamic groups from step 4 and use naming conventions for geography, department, device type, or deployment mode.

6. Configure the Enrollment Status Page

• Devices > Windows > Windows enrollment > Enrollment Status Page. It tracks three phases: device preparation, device setup and account setup; device-targeted work runs before the user context exists.
• Block the desktop only for the apps and policies that are truly required, prefer Win32 apps with reliable detection rules, and test on the hardware and networks your users actually use; blocking on large or unreliable apps is the most common cause of slow or failed enrollments.

Security and governance settings to review before rollout

Autopilot success is not only about device registration. Security policies can directly affect the out-of-box experience.

Review these items before production deployment:

• MFA and Conditional Access: strong authentication is recommended, but policies must be tested during Autopilot. Avoid blocking enrollment because a device is not yet compliant during its first sign-in.
• Device compliance policies: define what makes a device compliant, such as encryption, secure boot, firewall, antivirus, OS version, and risk state.
• Enrollment restrictions: block unsupported platforms and decide whether personal Windows device enrollment is allowed. Many organizations restrict enrollment to corporate-owned or Autopilot-registered devices.
• Device platform restrictions: prevent accidental enrollment of unmanaged or unsupported device types.
• Windows Hello for Business: decide whether to require it during provisioning, after enrollment, or through a staged rollout.
• Local administrator policy: decide whether users should be standard users or local administrators. For most organizations, standard user is the safer default.
• Role-based access control: limit who can create Autopilot profiles, import devices, change enrollment settings, and perform wipe or reset actions.
• Device Enrollment Managers: use only when needed and monitor carefully, because these accounts can enroll multiple devices.
• App deployment reliability: test required apps, scripts, Win32 packages, and security agents so they do not delay or break provisioning.

Windows subscription activation in 2026

Subscription activation is still useful when you want eligible users to move from Windows Pro to a higher edition without reimaging.

Common examples:

• Microsoft 365 E3/E5 or Windows Enterprise E3/E5 can activate Windows Enterprise features for licensed users on eligible Windows Pro devices.
• Microsoft 365 Business Premium includes Windows Business benefits for eligible devices, but it is not the same as Windows Enterprise E3/E5.
• The user must have the appropriate license assigned and must sign in with their work account.

This is especially relevant when you plan to use Enterprise-only security and management capabilities. Confirm licensing before designing policies that depend on a specific Windows edition.

Licensing notes for CSP and NCE customers

Business Premium is the practical baseline for most small and midsize organizations; larger or more regulated organizations often standardize on Microsoft 365 E3 or E5, depending on security, compliance, and Windows Enterprise requirements.

Under the Cloud Solution Provider program and New Commerce Experience subscriptions, licensing should be reviewed before rollout because add-ons, Frontline plans, Windows Enterprise rights, Intune capabilities, and Entra ID features vary by SKU. Do not assume that every Microsoft 365 plan includes the same Autopilot, Intune, Conditional Access, or Windows activation capabilities.

A practical rollout plan

A safe Autopilot rollout usually follows this path:

1. Pilot with a small group of IT-owned test devices.
2. Register devices and confirm profile assignment.
3. Test the complete out-of-box experience on a clean device.
4. Validate app installation, security baselines, compliance, encryption, and Conditional Access.
5. Test Autopilot Reset and device reassignment.
6. Expand to a user pilot group across departments and locations.
7. Document the support process for failed enrollments, device replacement, and remote users.
8. Move new device procurement to OEM or partner registration so devices arrive ready for Autopilot.

When an enrollment fails, check in order: device registered in the right tenant, group membership and profile assignment complete, network reaching Microsoft endpoints, user licensed and inside the MDM user scope, TPM attestation on self-deploying devices, and no app timing out on the Enrollment Status Page.

The goal is a repeatable device lifecycle from purchase through retirement, not just zero-touch deployment; our zero-touch deployment article covers day two.

Frequently asked questions

Do I need Microsoft Entra ID P1 for Windows Autopilot?

For automatic MDM enrollment and Conditional Access, yes: Entra ID P1 standalone ($84.00 per user per year, Microsoft list price, October 2026 price list) or a suite that includes it, such as Business Premium or Microsoft 365 E3/E5.

What is the difference between Autopilot Reset and Wipe?

Autopilot Reset keeps the Microsoft Entra join and Intune enrollment and removes user data, apps and settings, so the device goes to the next user as a managed device. Wipe resets the device fully and can return it to the out-of-box experience, which is the choice when ownership or tenant changes.

Sources

• Windows Autopilot overview — Microsoft Learn, checked via search 2026-10-11
• Manage apps in Microsoft Store for Business and Education — Microsoft Learn, checked via search 2026-10-11 (retirement postponed; tab removed April 2023)
• What is Conditional Access? — Microsoft Learn, ms.date 27 April 2026, read from the MicrosoftDocs GitHub source on 2026-10-11
• Windows 10 end of support — Microsoft, opened 2026-10-11
• Microsoft, US commercial price list, October 2026

Key takeaways

• Windows Autopilot remains the deployment method of choice in 2026, but deployments should be designed around Windows 11, Microsoft Intune, and Microsoft Entra ID.
• Replace Azure AD terminology and portal paths with Microsoft Entra admin center and Microsoft Intune admin center workflows.
• Licensing matters: Intune Plan 1 ($96.00), Entra ID P1 ($84.00), Business Premium ($264.00) and Microsoft 365 E3 ($468.00) per user per year carry different rights (Microsoft list price, October 2026 price list).
• One lifecycle action per situation: Autopilot Reset for reassignment, Wipe for ownership changes, Fresh Start for a clean install, Retire for BYOD, Delete for records only.
• Security policies such as MFA, Conditional Access, compliance, enrollment restrictions, and Windows Hello for Business must be tested during the Autopilot experience.

If you want a clean Windows 11 deployment process without maintaining images, IT Partner's Microsoft Intune Initial Setup for Windows Autopilot and Zero-Touch Deployment is $1,300 per project, quoted in writing before work begins: enrollment, branding, profiles, groups and the Enrollment Status Page, with the rollout plan above applied to your devices.