Zero-Touch Windows Enrollment

Build a Windows Autopilot self-deploying pipeline for zero-touch device enrollment.

Introduction

30 Second Summary

Every time a company ships a new laptop to an employee, someone in IT traditionally has to configure it by hand. Multiply that by hundreds of devices across multiple offices and you have a serious bottleneck.

In this project, you will build a zero-touch Windows enrollment pipeline using Windows Autopilot self-deploying mode. Your device will power on, connect to the network, and fully configure itself with zero human interaction.

What You'll Build

You will reset a Windows device and watch it automatically join your organization, enroll in management, install assigned policies, and land at the sign-in screen ready for any employee to use.

By the end of this project, you'll have:

A device that powers on and configures itself with zero interaction from IT or the end user, proving you can deploy Windows endpoints at enterprise scale.
An Enrollment Status Page displaying real-time progress as policies and apps are applied during setup, so no one signs in to an unconfigured device.
A fully managed endpoint visible in your Intune admin center as Microsoft Entra joined and compliant, with a reusable pipeline for any new device you add.
Secret Mission: Create and assign a device configuration profile that pushes security settings during the Autopilot enrollment flow.

Are there any prerequisites?

This project requires a Microsoft 365 E3 or E5 tenant with Intune and Entra ID P1/P2 active. You also need Global Administrator or Intune Administrator access.

You will need a physical Windows 11 device with TPM 2.0 connected to your corporate network. Virtual TPMs may fail during self-deploying mode attestation.

Before We Start

Before we dive in, let's lock in what you're about to build and why it matters for your organization's device management strategy.

Enable Automatic MDM Enrollment in Entra ID

For Windows Autopilot to enroll devices without any user interaction, the device needs a way to automatically register itself with your management platform.

That bridge is automatic MDM enrollment. It tells Microsoft Entra ID to hand off every device that joins your organization directly to Microsoft Intune. Without it, a device would complete the Autopilot OOBE and then stall because nothing tells it where to get policies and apps.

In this step, get ready to:

Sign in to the Azure portal and navigate to the MDM enrollment settings.
Set the MDM user scope to All so every device can self-enroll.
Verify the default MDM URLs are in place and save the configuration.

Sign in to the Azure portal and open the MDM settings

The MDM enrollment setting lives inside Microsoft Entra ID, not inside the Intune admin center. You configure it in the Azure portal.

Open your browser and navigate to https://portal.azure.com.
Sign in with your Global Administrator or Intune Administrator account.
In the Azure portal home page, select Microsoft Entra ID from the left-hand menu or the search bar.
In the Overview screen, find the Manage section in the left-hand pane.
Select Mobility (MDM and WIP).
Under Name, select Microsoft Intune.

You should now see the Microsoft Intune configuration page with MDM user scope and URL fields.

What is automatic MDM enrollment?

MDM stands for Mobile Device Management. Automatic MDM enrollment means that any device joining your Microsoft Entra ID tenant is automatically handed off to Intune for management.

Without this setting, a device joining Entra ID would just sit there with no policies, no apps, and no compliance checks applied. The Autopilot flow would stall after the device joins your directory.

Set the MDM user scope to All

Under MDM user scope, select All.

What do the MDM user scope options mean?

There are three options for the MDM user scope:

None disables automatic enrollment entirely. No devices will auto-enroll.
Some restricts automatic enrollment to members of specific Entra ID groups.
All enables automatic enrollment for every user in the tenant.

For this project, All is the simplest choice. In a production environment, you might use Some to target a pilot group first.

Verify the default MDM URLs and save

Below the MDM user scope, you should see three URL fields already populated with default values.

Confirm that MDM terms of use URL, MDM discovery URL, and MDM compliance URL all contain values (they are pre-filled by Microsoft).
If any URL field is blank, click Restore default MDM URLs to repopulate them.
Click Save at the top of the page.

What do these MDM URLs do?

These URLs tell devices where to find the Intune enrollment service. The MDM discovery URL points devices to the enrollment endpoint. The MDM terms of use URL provides the terms the device must accept. The MDM compliance URL is the endpoint for compliance checks.

You do not need to edit these values. Microsoft pre-fills them when your tenant has an active Intune subscription.

MDM URLs are blank?

If the URL fields are empty and Restore default MDM URLs does not appear, confirm that your tenant has an active Microsoft Intune subscription and that you are selecting Microsoft Intune (not Microsoft Intune Enrollment) under the Mobility page.

Help me troubleshoot blank MDM URLs in my Entra ID Mobility settings.

Confirm the setting is active

Before you move on, verify that your configuration saved successfully.

Navigate away from the Microsoft Intune page by selecting Mobility (MDM and WIP) in the breadcrumb or left-hand menu.
Select Microsoft Intune again to reopen the configuration page.

What do you expect to see when you reopen this page?

The MDM user scope should display All. The three MDM URL fields should still show their default values. This confirms your configuration persisted.

Your tenant now knows to automatically enroll any joining device into Intune. Next up, you will register your test device with Windows Autopilot so it can take advantage of this enrollment path.

Register the Device and Import to Autopilot

Automatic MDM enrollment is now active, so devices can self-enroll into Intune. The next piece of the puzzle is making Windows Autopilot recognize your specific device before it powers on.

Every device has a unique hardware hash that acts as its fingerprint. Without this fingerprint registered in Autopilot, the device will go through normal Windows setup (OOBE) instead of the zero-touch flow.

In this step, get ready to:

Collect the hardware hash from your test device using PowerShell.
Import the hardware hash CSV into the Intune admin center.
Verify the device appears in the Windows Autopilot devices list.

Collect the hardware hash from the test device

The hardware hash is a unique identifier calculated from your device's hardware components (motherboard, TPM chip, firmware). You will collect it using a PowerShell script and save it as a CSV file for upload.

On your test Windows 11 device, press the Windows key to open the search bar.
Type PowerShell in the search bar.
Right-click Windows PowerShell and select Run as administrator.
If prompted by User Account Control, click Yes to allow elevated access.

Prepare the environment and collect the hardware hash by running these commands one at a time:

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
New-Item -Type Directory -Path "C:\HWID"
Set-Location -Path "C:\HWID"
$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Install-Script -Name Get-WindowsAutopilotInfo
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

What do these commands do?

The first line enforces TLS 1.2 so PowerShell can securely download from the gallery.
Lines 2-3 create a C:\HWID folder and move into it. This is where the CSV will be saved.
Line 4 adds the Scripts folder to your session's PATH so you can call the script after installing it.
Line 5 allows downloaded scripts to run for this session only.
Line 6 installs the Get-WindowsAutopilotInfo script from the PowerShell Gallery.
Line 7 runs the script and writes the hardware hash to AutopilotHWID.csv.

Expect prompts during installation

When you run Install-Script, PowerShell may ask you to install the NuGet provider and confirm the untrusted PSGallery repository. Enter Y and press Enter for each prompt to continue.

Confirm the CSV file was created by running:

dir C:\HWID\AutopilotHWID.csv

You should see AutopilotHWID.csv listed with a file size greater than 0. This file contains your device's serial number and hardware hash.

Don't see the CSV file?

Make sure you ran PowerShell as administrator. The script needs elevated privileges to read hardware information.
If Get-WindowsAutopilotInfo was not recognized, confirm Install-Script completed successfully and re-run the PATH line.
help me troubleshoot the Get-WindowsAutopilotInfo script failing to produce a CSV on my Windows 11 device

Now you need to transfer this CSV to a computer where you can access the Intune admin center. Copy C:\HWID\AutopilotHWID.csv to a USB drive, shared network location, or email it to yourself.

Import the CSV into the Intune admin center

With the hardware hash collected, you will upload it to the Intune admin center so Autopilot knows about your device.

Open a browser and navigate to intune.microsoft.com.
Sign in with your administrator credentials (the same account you used for the Azure portal).
In the left navigation, select Devices.
Select By platform and then Windows.
Under Device onboarding, select Enrollment.
Select Windows Autopilot, then select Devices.
Click Import in the toolbar at the top.
Browse to the AutopilotHWID.csv file you transferred, select it, and click Import.

The import takes several minutes to process. A notification appears in the Intune admin center when it completes.

Why does the import take so long?

Microsoft validates the hardware hash against the Autopilot service and registers the device identity. This cloud-side processing ensures only legitimate device fingerprints are accepted into your tenant.

Verify the device appears in the Autopilot devices list

After the import finishes, you need to sync and refresh to see the device in the list. Syncs are rate-limited to once every 10 minutes, so if you just imported, the button will be available immediately.

On the same Windows Autopilot > Devices page, click Sync in the toolbar.
Wait for the sync to complete (a notification confirms it).
Click Refresh to reload the device list.

Before you look at the list, predict what you expect to see. What identifier should your device show?

Your test device now appears in the list with its serial number. The Profile status column shows Not assigned because you have not yet created a deployment profile.

Device not appearing after refresh?

Confirm the import notification showed success. If it failed, re-check that your CSV was generated correctly (non-zero file size, proper columns).
Wait the full 10 minutes before trying Sync again. The service throttles sync requests.
If the device imported but shows an error status, verify your device has a TPM 2.0 chip. Self-deploying mode requires hardware TPM attestation.
help me troubleshoot my Autopilot device not appearing in the Intune admin center after CSV import

Your device is now registered with Windows Autopilot. Next up, you will create a device group and a self-deploying deployment profile that tells this device exactly how to behave during its first boot.

Create a Device Group and Self-Deploying Profile

Your test device is registered in the Autopilot devices list, but Autopilot still does not know what to do with it during setup.

Two pieces solve this. A deployment profile tells the device how to behave during the out-of-box experience (OOBE). A device group targets that profile to the correct hardware. Without both, your registered device still goes through normal Windows setup instead of self-deploying.

In this step, get ready to:

Create a device group in Microsoft Entra ID containing your Autopilot device.
Create a self-deploying Windows Autopilot deployment profile in Intune.
Assign the profile to the device group.

Create a device group in Microsoft Entra ID

The device group acts as the assignment target for the Autopilot deployment profile and the Enrollment Status Page you will configure in the next step.

Open the Microsoft Entra admin center at entra.microsoft.com and sign in.
In the left-hand navigation, browse to Microsoft Entra ID, then select Groups.
Select All groups, then select New group.

For Group type, select Security.
For Group name, enter a descriptive name such as Autopilot Self-Deploying Devices.
For Group description, enter Devices targeted for Autopilot self-deploying mode.
For Microsoft Entra roles can be assigned to the group, leave this set to No.
For Membership type, select Dynamic Device.

Why Dynamic Device?

A dynamic group automatically captures devices based on a rule. Any future Autopilot-registered device matching the rule joins the group without manual work.

If you prefer manual control for testing, you can choose Assigned instead and add your device directly. Both approaches work for this project.

Under Dynamic device members, select Add dynamic query.
In the Dynamic membership rules screen, select Edit in the Rule syntax section to open the text box.
Paste the following rule into the Rule syntax text box:

(device.devicePhysicalIDs -any (_ -startsWith "[ZTDid]"))

What does this rule do?

This rule matches any device whose physical IDs contain a value starting with [ZTDid]. Every device registered in Windows Autopilot gets a ZTDid tag, so this rule captures all your Autopilot devices automatically.

Select OK to close the rule editor.
Select Save on the toolbar to save the dynamic membership rule.
Back on the New group page, select Create.

After creation, your new group appears under Groups | All groups. Dynamic groups can take several minutes to populate members.

Group not showing your device?

Dynamic group membership can take 5 to 15 minutes to evaluate. Wait a few minutes, then refresh the group's Members page.

If the device still does not appear, verify the device is registered in the Windows Autopilot devices list from the previous step. If you chose Assigned membership instead, make sure you manually added your test device under Members before clicking Create.

Help me troubleshoot my Autopilot device group membership

Create a self-deploying deployment profile

The deployment profile tells Windows Autopilot to suppress all OOBE screens and deploy the device without any user interaction.

Switch to the Microsoft Intune admin center (intune.microsoft.com).
In the Home screen, select Devices in the left-hand pane.
Under By platform, select Windows.
Under Device onboarding, select Enrollment.
Under Windows Autopilot, select Deployment Profiles.
Select the Create Profile dropdown menu, then select Windows PC.

On the Basics page, enter a Name for the profile (for example, Self-Deploying Profile).
Enter an optional Description.
Select Next.

On the Out-of-box experience (OOBE) page, for Deployment mode, select Self-Deploying.
Confirm Join to Microsoft Entra ID as shows Microsoft Entra joined. This field is greyed out because self-deploying mode only supports Microsoft Entra join.
For Language (Region), select Operating system default or choose your preferred language.
For Automatically configure keyboard, select Yes to skip the keyboard selection page during OOBE.
Select Next.

Why are most settings greyed out?

Self-deploying mode automatically hides the license terms, privacy settings, and account options. These fields are locked because the mode is designed for zero user interaction. The device authenticates using its TPM 2.0 chip instead of a user account.

Assign the profile to your device group

On the Assignments page, under Included groups, select Add groups.
In the Select groups to include pane, search for and select the device group you created earlier (Autopilot Self-Deploying Devices).
Select Select to close the groups pane.
Select Next.
On the Review + Create page, confirm the settings are correct.
Select Create to save and assign the profile.

Before you check the result, what do you expect to see in the Deployment Profiles list now that you have saved the profile?

Navigate back to Devices in the left-hand pane.
Under By platform, select Windows.
Under Device onboarding, select Enrollment.
Under Windows Autopilot, select Deployment Profiles.

You should see your self-deploying profile listed with its name and an assignment status indicating it is targeted at your device group.

Profile not showing as assigned?

Confirm you selected your device group on the Assignments page before clicking Create. If you missed this, open the profile, select Properties, then edit the Assignments section to add your group.

Help me troubleshoot my Autopilot deployment profile assignment

Your device group and self-deploying profile are ready. Next up, you will configure the Enrollment Status Page so the device blocks access until all policies finish applying.

Configure the Enrollment Status Page

Your Autopilot profile and device group are wired up. When the test device resets, it will pull the self-deploying profile, join Entra ID, and enroll in Intune. But there is a timing gap that can undermine the entire zero-touch promise.

Without an Enrollment Status Page (ESP), the device jumps straight to the Windows sign-in screen before policies and apps finish installing. Anyone who signs in at that point gets an unconfigured, non-compliant device. In this step, you will create a custom ESP that blocks device use until setup is fully complete.

In this step, get ready to:

Create a custom Enrollment Status Page profile in the Intune admin center.
Configure the ESP to show configuration progress and block device use until setup completes.
Assign the ESP profile to your device group.

Navigate to the Enrollment Status Page settings

The default ESP in Intune does not show app and profile installation progress. Microsoft recommends creating a custom ESP profile that displays progress and blocks device access until setup is fully complete.

In the Intune admin center, select Devices in the left navigation.
Select Windows under By platform.
Select Device onboarding, then Enrollment.
Under Windows Autopilot, select Enrollment Status Page.
Select Create to start the new profile wizard.

You should see the Create profile wizard open on the Basics page.

Why not use the default ESP?

Intune includes a default Enrollment Status Page, but it does not show app and profile progress to the user. The device would appear ready at the sign-in screen while policies are still being applied in the background.

A custom ESP profile overrides this behavior by displaying real-time progress and blocking access until everything is installed. This guarantees that no one touches the device in a half-configured state.

Name the profile and configure settings

On the Basics page, enter a descriptive name for the profile (for example, Autopilot Self-Deploy ESP).
Select Next to proceed to the Settings page.
Toggle Show app and profile configuration progress to Yes.

After toggling this to Yes, additional options appear on the page.

Set Block device use until all apps and profiles are installed to Yes.
Leave the remaining settings at their defaults.
Select Next to proceed to the Assignments page.

What do these settings do?

Show app and profile configuration progress displays a real-time progress screen during OOBE showing which policies and apps are being downloaded and installed.

Block device use until all apps and profiles are installed prevents anyone from reaching the desktop until every assigned configuration finishes applying. This is what ensures the device is fully compliant before use.

Assign the ESP to your device group and save

The ESP profile is assigned to a device group, not to individual devices. You will target the same device group you created for your Autopilot deployment profile.

On the Assignments page, select Add groups.
Search for and select the device group you created in the previous step (the group containing your Autopilot test device).
Select Next to proceed to the Review + create page.
Review your settings, then select Create to save and assign the ESP profile.

Before you check, do you expect to see your new profile in the Enrollment Status Page list immediately, or will it take time to propagate?

Navigate back to Devices > Windows > Device onboarding > Enrollment > Enrollment Status Page.
Confirm your new ESP profile appears in the list.

Your custom ESP profile should appear immediately in the list. You can select it to verify that Show app and profile configuration progress is set to Yes and the assigned group matches your device group.

Don't see your ESP profile in the list?

Make sure you selected Create on the final Review + create page. If you navigated away before completing the wizard, the profile was not saved.

If the profile exists but shows no assignment, select the profile, go to Properties > Assignments, and add your device group there.

Help me troubleshoot my Enrollment Status Page profile in Intune.

Your zero-touch pipeline is now fully assembled. The Autopilot profile tells the device to self-deploy, and the ESP ensures no one touches it until every policy lands. Next up, you will reset the device and watch the entire pipeline run end to end with zero interaction.

Deploy and Verify the Zero-Touch Enrollment

Every piece of the Autopilot pipeline is now in place. You have automatic MDM enrollment, a registered device, a device group, a self-deploying profile, and a custom Enrollment Status Page.

This step is the payoff. You will factory reset your test device, connect it to a wired network, and watch it configure itself from scratch with zero interaction. The device will join Microsoft Entra ID, enroll in Intune, and land at the Windows sign-in screen completely hands-off.

In this step, get ready to:

Factory reset the test device and connect it to a wired network.
Observe the zero-touch Autopilot self-deploying process end to end.
Verify the device appears as managed in the Intune admin center.

Factory reset the test device

For Autopilot self-deploying mode to take over, the device must boot into the Windows Out-of-Box Experience (OOBE). A factory reset wipes the current installation and forces OOBE on next boot.

On your test device, open Settings.
Select System, then Recovery.
Under Reset this PC, select Reset PC.
Choose Remove everything. This reinstalls Windows and removes all personal files, apps, and settings.
Select Local reinstall (faster) or Cloud download (fresh copy from Microsoft).
Confirm the reset. The device will restart and begin wiping itself.

Why Remove everything?

Autopilot self-deploying mode requires the device to enter the Out-of-Box Experience (OOBE) from a clean state. Choosing Remove everything ensures no previous enrollment data or cached profiles interfere with the fresh Autopilot provisioning.

While the device is resetting, connect an Ethernet cable to the device. A wired connection ensures zero interaction is required during setup.

Why a wired connection?

On a wired Ethernet connection, the Autopilot profile can pre-set the language, locale, and keyboard layout so those OOBE screens are skipped entirely. On Wi-Fi, the device must prompt for a network selection, which requires manual interaction.

The reset process takes several minutes. Once complete, the device restarts into OOBE.

Observe the Autopilot self-deploying process

Once the device finishes resetting and boots into OOBE with the Ethernet cable connected, the Autopilot process begins automatically. Do not touch the keyboard or mouse.

Watch the device screen. The device connects to the network and downloads the Windows Autopilot profile from the deployment service.
Because you are on a wired connection and the profile is configured to skip language and keyboard screens, OOBE screens are bypassed automatically.
The device may reboot once to apply critical security updates. This is normal.
After any updates, the Enrollment Status Page (ESP) appears. It displays progress across two phases: Device preparation and Device setup.
During Device preparation, the device performs TPM attestation and joins Microsoft Entra ID.
During Device setup, the device enrolls in Intune and receives any assigned policies or apps.
Once Device setup completes, the Windows sign-in screen appears. The self-deploying provisioning is finished.

How long does this take?

The provisioning process typically takes 10 to 30 minutes depending on your network speed, whether security updates are available, and how many policies are assigned. The default ESP timeout is 60 minutes.

Do not power off or disconnect the device during this process. Let it complete on its own.

Device stuck or showing an error?

If the device stalls or shows error 0x800705B4, this is a TPM attestation timeout. It can happen when the device is not TPM 2.0 capable or the clock is significantly off. Press Shift+F10 to open a command prompt, then run:

w32tm /resync /force

Then restart the device with:

shutdown.exe /r /t 0

If you see error 0x80180014, the device was previously enrolled and needs its record unblocked. In the Intune admin center, go to Devices > Windows > Enrollment > Windows Autopilot > Devices. Select the affected device and choose Unblock device. Then reset the device again.

Help me troubleshoot my Autopilot deployment

Verify the enrollment in the Intune admin center

The device has reached the Windows sign-in screen with zero interaction from you. Before you move on, confirm that Intune recognizes it as a managed endpoint.

Before you check, what do you expect to see for this device in the Intune admin center? Think about what join type and management authority it should show.

Switch back to the Intune admin center in your browser.
Navigate to Devices > All devices.
Locate your test device in the list. It appears with the serial number you registered earlier.
Select the device to open its properties.
Confirm the following values:

Join type shows Microsoft Entra joined.
Managed by shows Intune.
Enrollment profile shows Windows Autopilot or the name of your self-deploying profile.

Your device went from a blank factory state to a fully managed, Entra-joined endpoint without a single user interaction. That is zero-touch deployment in action.

Device not showing in All devices?

Enrollment data can take a few minutes to propagate. Wait 5 minutes and refresh the page.

If the device still does not appear, confirm that the Autopilot process completed by checking the Enrollment Status Page reached 100% before the sign-in screen appeared. If the ESP showed an error, the device may not have enrolled successfully.

Help me find my device in the Intune admin center

Your zero-touch pipeline is fully operational. Next up, you will take on the Secret Mission and push a device configuration profile that applies security settings during enrollment.

Secret mission

Push a Device Configuration Profile During Enrollment

Your zero-touch pipeline enrolls devices, but a truly production-ready deployment pushes security policies before anyone touches the machine. In this mission, you'll create a device configuration profile in Intune that enforces a visible security setting during the Autopilot enrollment flow.

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project runs entirely within your existing Microsoft 365 E3/E5 licensing, so there are no ongoing costs for the resources you created.

Resources you used:

Windows Autopilot deployment profile in the Intune admin center.
Enrollment Status Page profile in the Intune admin center.
Device group in Microsoft Entra ID.
Device configuration profile in the Intune admin center (Secret Mission).
Windows Autopilot device registration in the Intune admin center.
Hardware hash CSV file on the test device.

Keep everything running

No action needed. Choose this if you plan to register more devices with Autopilot or continue testing your self-deploying pipeline.

Your Autopilot deployment profile and ESP remain active. Any new device you register and add to your device group will automatically self-deploy through this pipeline.
The device configuration profile continues to enforce your security settings on any device in the assigned group.
Your test device remains enrolled in Intune and managed by your organization.

Pause - I'll come back to this later

Unassign the deployment profile from the device group to stop new devices from using it, while keeping the entire configuration intact for later.

In the Intune admin center, select Devices, then By platform, then Windows, then Device onboarding, then Enrollment, then Windows Autopilot, then Deployment Profiles.
Select your self-deploying profile, then open Assignments.
Remove your device group from the assignment, then select Save.
Your profiles, device group, and Autopilot registration remain in place. When you are ready to resume, re-assign the profile to the group.

Delete - I don't want to use this again

Remove all project resources to start fresh. Follow these steps in order to avoid dependency errors.

Delete the device configuration profile. In the Intune admin center, select Devices, then Manage devices, then Configuration. Select your device restrictions profile, then select Delete and confirm.
Delete the Enrollment Status Page profile. In the Intune admin center, select Devices, then By platform, then Windows, then Device onboarding, then Enrollment, then Windows Autopilot, then Enrollment Status Page. Select your custom ESP profile and select Delete.
Delete the Autopilot deployment profile. In the same Windows Autopilot section, select Deployment Profiles. Select your self-deploying profile and select Delete.
Remove the device from Autopilot. In the same Windows Autopilot section, select Devices. Select your test device and select Delete to deregister it.
Delete the managed device record. Select Devices, then All devices. Select your test device and select Delete.
Delete the device group. In the Microsoft Entra admin center, browse to Groups, then All groups. Search for and select your Autopilot device group, then select Delete.
Delete the hardware hash CSV file. On your test device, navigate to C:\HWID and delete the AutopilotHWID.csv file.

Nice Work!

Nice work! You just built a complete zero-touch Windows enrollment pipeline using Windows Autopilot self-deploying mode. Your device went from factory-fresh to fully managed without a single user interaction.

You've learned how to:

Configured automatic MDM enrollment in Microsoft Entra ID and registered a device hardware hash using PowerShell to connect your Windows device to the Autopilot service.
Created a self-deploying deployment profile and Enrollment Status Page that suppress all OOBE interaction and block device access until setup completes.
Deployed and verified a device going from factory-fresh to fully managed with zero user interaction, proving the entire pipeline works end to end.
(Secret Mission) Created and applied a device configuration profile that enforces security settings during the Autopilot enrollment flow.

Ready to quiz yourself?