Windows 10/11 All about Windows Autopilot

Software Requirements

The following operating system versions are supported for Windows Autopilot. Ensure to try to use Windows Autopilot with one of the following Windows 10 or Windows 11 editions:

• Windows 10/11 Pro
• Windows 10/11 Pro Education
• Windows 10/11 Pro for Workstations
• Windows 10/11 Enterprise
• Windows 10/11 Education

Licensing Requirements

Windows Autopilot depends on specific capabilities in the Windows 10 or Windows 11 clients and on Azure Active Directory and for sure it requires a Mobile Device Management solution like Silverback, but we think by starting with this guide you have already Silverback and a valid license in place. To meet the licensing requirements from Microsoft, you can obtain these capabilities through several editions and subscriptions programs. The following overview shows the specific possible programs:

• Microsoft 365 Business Premium subscription
• Microsoft 365 F1 or F3 subscription
• Microsoft 365 Academic A1, A3, or A5 subscription
• Microsoft 365 Enterprise E3 or E5 subscription, which include all Windows client, Microsoft 365, and EMS features (Azure AD).
• Enterprise Mobility + Security E3 or E5 subscription, which include all needed Azure AD features.
• Intune for Education subscription, which include all needed Azure AD features.
• Azure Active Directory Premium P1 or P2

Please review the current licensing requirements from the following link at your time of starting with your project: Windows Autopilot licensing requirements. In general, you need next to a valid Silverback license, the automatic MDM enrollment and company branding features from Azure Active Directory. With Azure Active Directory Premium P1 or P2 you might already be ready to go with Windows Autopilot from the minimum requirements point of view. In case you have doubts about the right subscription from Microsoft, please contact your reseller or partner. If you have in your subscription Intune in place, it will provide you more features then without as we will show this later in this guide.  

A well-known indication that you might not have the sufficient subscription is when you try to add your MDM and MAM application and your view does not look like that. If you do not see the MDM user scope, then you should get in touch with your reseller or partner. 

Network Requirements

Windows Autopilot depends on a variety of cloud and internet-based services like the Windows Autopilot Deployment Service, Azure Active Directory, Windows Update and further. Please review the following Windows Autopilot networking requirements to ensure that your network is properly configured and prepared. Please refer to the Unsupported Feature section in this guide, to ensure to configure the right and only necessary services parts. As an example, the Hybrid Domain Join is at this stage not supported, so you don't' have to configure this network requirement for now. If you do not have Intune in your subscription, you also don't need to configure the service requirements for Intune, and so on.

Configuration Requirements

For Windows Autopilot, you can split the configuration into several parts of the services that will be used. Please refer to the official Windows Autopilot configuration requirements before we are starting with comparing what we need:

Get Hardware ID 

• Please perform the Get Hardware ID section in the following guide: Azure AD Integration III: Windows Autopilot

Upload in Intune

• Login to https://endpoint.microsoft.com/
• Navigate to Devices and select Enrollment in the Device onboarding section
• In the Windows Autopilot section, select Devices
• Click Import and select the *.csv file and press upload

Upload via Unified User Experience

• First, you will need to install and configure the Windows Autopilot Extension
• After the successful integration, you can perform the following steps: Add Devices to Windows Autopilot

Review Devices in Azure Active Directory

You can navigate after uploading devices to Windows Autopilot to your Azure Active Directory > Devices > All Devices. Autopilot devices will be displayed with a different icon. When you hover over the icon, you will see the Autopilot Device information. Please note that recently uploaded devices may be indicated by their serial numbers. The device name might change after the device was enrolled the first time to Azure Active Directory, e.g., via Autopilot.

Configuration

• Login as Administrator to your Silverback Management Console
• Navigate to the Admin tab
• Select Azure Active Directory
• Navigate to Terms & Conditions
• Customize your Terms of Conditions and press save

User Experience

After customizing your Terms of Use, you can press the Preview for dark theme or the Preview for light theme.  A new browser tab will open and will demonstrate the look & feel for your users during the enrollment process. As of today, the white theme will be shown for Azure Active Directory Joins, when the device will be joined after the out-of-the-box experience and the dark theme during enrollments through the out-of-the-box-experience. Themes are currently not related to Windows 10 or Windows 11, but this might change in the future.

Theme / Experience	Standard	Customized
Dark Theme for Windows 10 OOBE
Dark Theme for Windows 11 OOBE
Customized White Theme for Windows 10 and Windows 11 Azure Active Directory join

After customizing your Terms of Use and reviewing the User Experience, you might want to give a try to your Autopilot enrollment, but first we need to configure additional settings that will apply during the Out-of-the-box experience. These options are quite similar to the Device Enrollment Program for Apple devices and you might be already familiar with the profile creation for Apple devices

Profile Creation with Intune

• Login to https://endpoint.microsoft.com/
• Navigate to Devices and select Enrollment in the Device onboarding section
• In the Windows Autopilot section, select Deployment profiles
• Select Create Profile and select Windows PC
• Enter as Name, e.g. Autopilot Standard Profile
• Press Next
• Configure the following options 

• Press Next 
• At the assignment page, do not assign the profile now as we will do it later. 
• Press Next
• Press Create
• Wait for the Profile successfully created notification
• Proceed with End User Experience Screens or Profile Assignments

Profile Creation with Unified Endpoint Management

With Unified Endpoint Management, you can create, modify, and delete Windows Autopilot Profiles. Please note that the creation and assignment of Autopilot profiles in Intune is performed in two separate operations. With Unified Endpoint Management, the assignment is already done directly during the profile creation, so feel free to familiarize yourself with the next chapter Profile Assignments already at this point.

• Please refer to the following article to create, modify, delete, and assign Windows Autopilot Profiles

End User Experience Screens

With the Profile creation, you decide how the user experience will be after powering on the device for the device. To provide you an overview about the effects of the settings, this section will show you the screens that users might see or not. 

OS/Screen	Microsoft Software License Terms	Hide change account options
Windows 10
Windows 11
	Automatically Configure Keyboard	Automatically Configure Keyboard
Windows 10
Windows 11
	Administrator Account	Standard Account
Windows 10/11

Create a dynamic group in Intune 

As Intune only provides the assign feature via Groups, you can decide if you want to create a dynamic membership or a static membership group for assigning profiles. To create a dynamic membership, you can complete the following steps:

• Login to your Azure Portal and select Azure Active Directory
• Select Groups and click New group
• Enter a Group Name, e.g. Autopilot Dynamic Membership
• Enter a Group description
• Select as Membership Type Dynamic Device
• Click Add dynamic query
• Click Under Rule Sync edit
• Add the following Rule

(device.devicePhysicalIDs -any _ -contains "[ZTDId]")"

• Press OK
• Press Save
• Press Create
• Wait a couple of moments and press refresh to review your created group
• Proceed with Assign Profile to Group in Intune or depending or your needs, try to create a static group for Intune

Create a dynamic group with Unified Endpoint Management

As mentioned already in the chapter introduction, the Windows Autopilot integration in our Unified User Experience uses API calls to Microsoft Graph or Intune, which means that the mechanism of assigning profiles to groups is also the way to go. For this purpose, we have built in a quick option in the Unified Endpoint Management that can be used to create the dynamic group(s) very easily: 

• Please refer to the following article to create dynamic Autopilot device groups

Create a static group in Intune

Next to dynamic groups, you can create a static group in Azure Active Directory and assign the profile to this static group. To create a static group, perform the following and add afterwards each device that should receive the profile for this group: 

• Login to your Azure Tenant and select Azure Active Directory
• Select Groups and click New group
• Enter a Group Name, e.g. Autopilot Profile 1
• Enter a Group description
• Select as Membership Type assigned
• Click Members
• Search for your device(s) and select the target device(s)
• Press Select
• Press Create
• Wait a couple of moments and press refresh to review your created group
• Proceed with Assign Profile to Group in Intune

Assign Profile to Group in Intune 

• Start at the Windows Autopilot deployment profiles overview
• Select your Profile
• Click Properties
• Under Assignments, click edit
• Press Add under Included Groups
• Select your previously created group and confirm with Select
• Press Review + save
• Confirm with Save
• After some time, new devices should appear under the Assigned devices section

Assign Profile to Group with Unified Endpoint Management

If you create a Windows Autopilot profile via the Unified User Experience or via Unified Endpoint Management, the part of assigning the profile to groups is already integrated in the simplified profile creation wizard. 

• Please refer to the following article to create and assign Windows Autopilot Profiles

Autopilot Reset

With the Autopilot Reset functionality two scenarios are supported in general. One scenario is the Local reset that can be started as an example by an IT administrator if he has a physical access to the device and administrative permissions on the device. A remote reset can be executed by Silverback from any Administrators. 

Remote Reset

Remote Autopilot reset is an action that came with Silverback 22.0 and the Autopilot Reset works like a PC Reset, like the other Wipe operations that Silverback supports for Windows 10 and Windows 11 devices, except that the Autopilot reset keeps the device enrolled in Azure Active Directory and in Silverback. In addition to that the Autopilot reset will perform the following actions:

• Removes personal files, apps, and settings.
• Reapplies a device's original settings.
• Sets the region, language, and keyboard to the original values.

The Windows Autopilot Reset process automatically keeps information from the existing device:

• Wi-Fi connection details.
• Provisioning packages previously applied to the device.
• A provisioning package present on a USB drive when the reset process is started.
• Azure Active Directory device membership and Silverback enrollment information.

By executing a Remote Reset, the current user will receive a short notification that the Autopilot Reset is scheduled in 45 Minutes. 10 Minutes before the Autopilot reset will be initiated users will receive the final notification

First Notification	Final Notification

During the execution of Autopilot reset, you can review the status of the operation in the device overview.  Overall the following status information are available

• Complete
• Reset has been scheduled
• Reset is scheduled and waiting for a reboot

If errors appear during the Autopilot reset, a second line of information will be shown with an Error info: 

• Failed during CSP Execute
• Failed: power requirements not met.
• Failed: reset internals failed during reset attempt.

The Remote Autopilot reset can be helpful in break and fix scenarios, as the device remains in management and will reinstall distributed applications after the current or next user signs in with having a fresh setup of Windows 10 or Windows 11. Please be aware when Autopilot reset is executed on a device, the primary user of the device will be removed and the next user who signs will be set as the primary user in Azure Active Directory. As per current design, Silverback keeps the device enrolled with the initial owner of the device who performed the enrollment. Due to the vendor design of the Autopilot Reset feature, the Terms & Conditions must not be accepted again from the next user who logs in.

Successful Autopilot Reset	User Login Screen

In our test labs we experienced that for Windows 11 21H2  the You're about to signup notification does not appear and after the Autopilot reset, the next user is presented to enter the password prompt for the defaultuser0. By pressing Other Users, the next user is able to sign-in and sign-out defaultuser0. This behavior might change in the future for newer Windows 11 releases. 

Require Network In OOBE

The Require Network in OOBE option is available with Silverback 22.0 as a new restriction and this is a typical deployment program option. It will help to actively force a user to perform a device enrollment. As an example, for the Device Enrollment Program the similar option is the Force Enrollment setting and most likely it is doing the same but in a different way. During the out-of-the-box-experience of Windows 10 and Windows 11 devices, users might circumvent the Autopilot enrollment by just simply providing no internet connection. In this case, Windows 10 and Windows 11 device have by default, the I don't have internet connection available and if the user would press this button, they would be able to create a local account on the machine and use the device without being managed. The background here is that devices, doesn't matter to which deployment program they belong, require a network connection to receive a profile from this cloud service and it is pretty simple. No internet connection means no cloud service.

To prevent this situation, you can configure with Silverback the new Require Network in OOBE restriction, which correlates to a UEFI variable that is set to require a network connection and a change in Windows 10 1809 that checks this variable.  As compared in the following screenshots, the I don't have internet option will be shown or will be hidden during the out-of-the-box-experience, but you need to be aware that the device must be one time enrolled to Silverback to apply this restriction. So, at the first out-of-the-box-experience of the device, this option will be available. After the Autopilot setup, you can apply this restriction and during the next OOBE, this option will be hidden and kept active for all next OOBE scenario. That is how the TenantLockdown CSP is designed and mostly this feature is intended for users who accidentally reset they device. 

First OOBE with the I don't have internet option.	After applying the restriction and a factory wipe, the option will be hidden.

Please note, that users might have a second option to perform a local account creation and circumvent the Autopilot enrollment. If you have read the complete article, you might remember the Hide change account options in the Autopilot profile. If the Autopilot is set to show the account options, users could press at the sign-in page the Account options button and create a local account on the device, so to fully avoid the local account creation on devices, you must set this option to hide. 

Enable Agility Post Enrollment

Autopilot agility is a recently introduced feature that allows updates and bug fixes to the OOBE experience. Microsoft started rolling out this feature to Windows 10 1909 and 2004/20H2 with August (2021) cumulative update and is not yet available for Windows 11. From the documentation point, there are currently conflicting statements as the updates should occur either before or after the device enrollment and may result in an additional reboot and authentication prompt to the user. In our test lab we were able to set the Enable Agility Post Enrollment restriction to yes and the configuration was applied on the device.

Windows Autopilot configuration displays the applied restriction	In the MDM Diagnostic Report the Enable Agility Post Enrollment is set to 1

Assign a user to a device

You might have heard about a features that makes the experience for users even more powerful with predefining the username at the sign-in page for Windows Autopilot devices. The assign a user to a device during Windows setup feature was introduced by Microsoft in 2018 and has been deprecated in the meantime. Please refer to the following Updates to the Windows Autopilot sign-in and deployment experience article by the Intune support team about the background for the deprecation.