Windows Autopilot for IT Teams: Classic vs Device Preparation, Hybrid Join, Licensing and Error Codes

Updated: November 2026. Versions, limits, connector builds, licensing and error codes checked against Microsoft Learn on 11 November 2026.

A new Windows laptop needs a work account, policies and apps before it's usable, and imaging every model is a job of its own. Microsoft's answer now comes in two versions, with a reworked hybrid join connector and error codes that read like lottery numbers. This guide explains Windows Autopilot as of November 2026: how it works in Intune, which version to pick, registration, licensing and error fixes.

TL;DR

• What it is. A Microsoft service that turns a new PC's factory Windows into a managed work device without imaging.
• Two versions. Device preparation fits Entra-only Windows 11 rollouts; classic covers hybrid join, pre-provisioning, kiosks and Windows 10.
• Registration. Let the reseller or OEM register devices; Microsoft recommends manual hash uploads only for testing or limited cases.
• Hybrid join. Connector builds before 6.2501.2000.5 stopped processing enrollments in late June 2025.
• Licensing. Microsoft 365 Business Premium, E3 or E5 covers it, or Entra ID P1 or P2 with Intune.

What Is Windows Autopilot?

Windows Autopilot is a set of Microsoft technologies that turns the Windows install a new PC ships with into a managed, business-ready device during first setup. Once it's done, Intune or another management tool runs the device.

There's no imaging. Autopilot works on the Windows the OEM already installed, so there's no custom image or per-model driver pack to maintain. It adds settings, policies and apps, and can step the edition up from Pro to Enterprise. Our guide to Sysprep on Windows 11 covers where it replaces imaging.

How Windows Autopilot Works in Intune

Autopilot gets the device into Intune, and Intune manages it from then on. It runs in the out-of-box experience (OOBE), the setup screens a new PC shows on first boot. Microsoft's troubleshooting FAQ lists six steps. The device connects to a network, downloads its Autopilot profile and asks the user to sign in with Entra ID (formerly Azure AD). Then it joins Entra, enrolls in Intune and applies settings, mostly while the Enrollment Status Page (ESP) is on screen.

Admins find it all in the Intune admin center under Devices > By platform: Windows > Device onboarding: Enrollment > Windows Autopilot. The device needs ports 80, 443 and UDP 123, plus ztd.dds.microsoft.com and the Entra and Intune endpoints. Self-deploying and pre-provisioned devices also reach *.microsoftaik.azure.net for TPM attestation.

Classic Autopilot vs Autopilot Device Preparation

Microsoft runs two versions side by side. Classic Autopilot (v1) registers each device's hardware hash first. Autopilot device preparation (v2) went generally available (GA) on 3 June 2024. It skips that step and drops the device into a security group during enrollment, which carries its apps and policies.

Device preparation moved fast in 2026. The app limit rose to 25 on 30 January, and the managed installer for App Control for Business started applying in OOBE on 10 April. Automatic mode went GA for Windows 365 (Reserve aside) on 11 May, and device association landed on 27 August.

Microsoft's Windows At Work channel posted this Autopilot AMA in March 2026. The team covers device preparation vs classic, app limits, hybrid devices and co-management, though it predates device association.

Which Version to Pick

Start new Entra-only Windows 11 rollouts on device preparation. Stay on classic where it still does something v2 can't.

Windows 10 left support on 14 October 2025, and device preparation never ran on it. Classic still lists Windows 10 editions, though Learn says Autopilot doesn't support versions past their lifecycle. See our Windows 10 end-of-life guide for ESU.

Both versions can run in one tenant, but each device runs one. A registered device gets the classic profile unless it's associated for device preparation. To skip association, deregister it first.

How Devices Get Registered

Registration ties a device's hardware hash to your tenant, and classic Autopilot needs it. Microsoft prefers the OEM or reseller to do it. An OEM registers devices once a Global Administrator approves it, and a reseller or CSP does it in Partner Center after the same approval. Intune can also register corporate devices it already manages through a profile setting, Convert all targeted devices to Autopilot. Allow 48 hours for that to process.

Microsoft recommends uploading 4K hashes yourself only for testing or limited cases, partly because the hash holds sensitive data. For a test batch:

1. At OOBE, press Shift+F10 for a command prompt, or open PowerShell on a running PC.
2. Run Get-WindowsAutopilotInfo with -OutputFile to save a CSV, or -Online to upload it, signed in as at least an Intune Administrator.
3. Without the script, press Ctrl+Shift+D at OOBE on Windows 11, or export from Settings > Accounts > Access work or school.
4. Import the CSV under Windows Autopilot > Devices, one batch at a time.

The CSV takes up to 500 devices, with exact, case-sensitive headers and no extra columns or quotation marks. Save it as ANSI and edit it in Notepad, not Excel. ZtdDeviceAssignedToAnotherTenant on import means another tenant still holds the device.

A new motherboard needs a fresh hash. When a device leaves for good, delete it from Intune, then from Autopilot devices, and leave the Entra object alone. Add that to your asset retirement steps, because until then the device stays tied to your tenant.

Device preparation's optional answer to registration is device association. You export a CSV at OOBE (Windows key five times), upload it, and the device binds to your tenant with a TPM-backed marker in UEFI. It needs physical TPM 2.0 and Windows 11 24H2 or 25H2 with KB5120998 or later, and it isn't available in sovereign clouds yet. Learn documents only admin uploads today, one device per CSV.

An r/sysadmin rant from April 2026 asks why nearly every Autopilot setup the poster has seen still needs babysitting. Replies blame OEMs registering the wrong serial or hash, users setting up offline so devices land as personal, and slow app installs.

Deployment Profiles and the Enrollment Status Page

A deployment profile sets the mode, the join type, which OOBE pages to hide and whether users get admin or standard accounts. The name template works for Entra join only, up to 15 characters with %SERIAL% or %RAND:x%. Hybrid devices take a prefix from the domain join profile. Our device naming conventions guide helps pick a pattern.

Two rules catch admins out. A device in groups with two profiles gets the one created first, and profile edits only reach enrolled devices after a reset and re-enrollment.

The ESP holds the user on a progress screen until apps and policies land. These settings decide whether it finishes.

Deploy Microsoft 365 Apps as a Win32 app, because the built-in app type can hang the ESP. Our Microsoft 365 Apps install guide covers the Office Deployment Tool.

User-Driven, Pre-Provisioned and Self-Deploying Modes

Classic Autopilot's three main modes differ in who touches the device and what hardware it needs.

For pre-provisioning, a technician presses the Windows key five times at the first OOBE screen, selects Provision and then Reseal. Wait at least 90 minutes before the user flow, and run it within six months. It fails when any of four logon and UAC policies under Security Options are on. Check your interactive logon policies before the first run.

Self-deploying sets no primary user, which limits self-service BitLocker key recovery and user apps in Company Portal. It can run on Intune's device-only license. Both TPM modes fail without TPM 2.0, and our guide shows how to enable TPM 2.0.

Neither re-enrolls on its own after the first run. Unblock the device or delete its Intune record first, or you'll meet 0x80180014.

For PCs already in service, a Configuration Manager task sequence can reimage them and run Autopilot. Autopilot Reset wipes personal files and apps but keeps the device in Entra and Intune, and it doesn't support hybrid-joined devices. Our Autopilot Reset steps cover it.

Hybrid Join and the Intune Connector for Active Directory

Hybrid join puts a device in on-prem Active Directory and Entra ID at once. Microsoft says deploying new devices this way "isn't recommended, including through Windows Autopilot," and device preparation can't do it at all. Our Entra ID vs AD comparison covers the move.

If you still need hybrid, the Intune Connector for Active Directory creates the AD computer object for each device. The device needs line of sight to a domain controller during OOBE, or a VPN with Skip AD connectivity check set to Yes. Bring-your-own VPN doesn't work in pre-provisioning, and duplicate device objects in Entra are by design.

What Changed in 2025 and 2026

The connector moved off the SYSTEM account in 2025. It now runs as a managed service account it creates, named msaODJ plus five random characters.

Using your own gMSA was already documented. The June 2026 key only skips setup's Log on as a service check, which fails when that right hasn't reached the server yet.

In June 2025, an r/Intune post warned hybrid admins to upgrade before the cutoff. Replies confirm there's no in-place upgrade and share a fix for a WebView2 permissions error. The post links the author's own blog.

To replace a legacy connector:

1. Download ODJConnectorBootstrapper.exe from Intune Connector for Active Directory > Add in the Intune admin center.
2. In a single-connector domain, install the new connector on a second server first.
3. Uninstall the legacy connector by hand, since there's no automatic upgrade.
4. Install and sign in with an Intune administrator account that has an Intune license.
5. Optionally, list target OUs in ODJConnectorEnrollmentWizard.exe.config, then select Configure Managed Service Account.
6. Confirm Intune shows the connector as Active, on 6.2501.2000.5 or later.

Requirements and Permissions

The connector needs Windows Server 2016 or later with .NET Framework 4.7.2 or later, and the installer needs rights to create msDs-ManagedServiceAccount objects. By default, AD lets one account join only 10 computers. Delegate Create Computer objects on the target OU to the service account rather than making it a domain admin. Each connector serves only its own domain and each server runs one connector, so plan one per domain and add servers for redundancy. Logs sit under Applications and Services Logs > Microsoft > Intune > ODJConnectorService.

Windows Autopilot Licensing

Autopilot needs one of these, assigned to each user who enrolls, per Microsoft's requirements page (8 July 2025).

Office 365 E1, E3 and E5 aren't on the list. Self-deploying devices can use Intune's device-only license. Supported editions are Pro, Pro Education, Pro for Workstations, Enterprise, Education and Enterprise LTSC, and Windows Home fails with 0x80180022. For Intune's own prices, see our Microsoft Intune review.

Common Windows Autopilot Error Codes

Autopilot shows a hex code and little else. These causes and fixes come from Learn's troubleshooting FAQ, its known issues page and Intune's enrollment errors page.

Where Autopilot Logs Live

When the code isn't in the table, open Event Viewer at Application and Services Logs > Microsoft > Windows > ModernDeployment-Diagnostics-Provider > Autopilot. To bundle everything, run mdmdiagnosticstool.exe -area Autopilot;TPM -cab c:\autopilot.cab. Intune also collects diagnostics on failure and keeps them for 28 days.

Where Autopilot Stops

Autopilot's job ends at the desktop. Learn doesn't describe it monitoring devices, patching apps or giving remote access, and for remote sessions inside Intune there's Intune Remote Help.

It's also for Windows devices only. Android has its own path in Android zero-touch enrollment.

Macs and iPhones go through Apple Business enrollment instead.

If Intune isn't your only tool, our comparison of Intune with an RMM shows where each fits.

Autopilot gets the PC to the desktop. For the work after that, there's OpenFrame, open AI-native infrastructure for IT and security. It covers large areas of RMM, remote access and patching, with Fae resolving support requests and Mingo running IT operations. It costs $1 per device per month, with a 14-day free trial. Flamingo builds OpenFrame, which isn't part of Autopilot or Intune.

Windows Autopilot in Short

Windows Autopilot takes a new PC from its factory install to a managed desktop, and Intune takes over from there. Start new Entra-only Windows 11 rollouts on device preparation, keep classic for hybrid, kiosks and pre-provisioning, and keep any hybrid connector on 6.2501.2000.5 or later. A guide to the Intune Management Extension is on the way. Until then, read our Windows MDM enrollment guide for the other ways a Windows device gets into Intune.