Autopilot Device Prep stopped working

Matt Dillon 437 Reputation points
2026-08-24T16:16:02.7066667+00:00

I had this working a week ago in one tenant. Created the Autopilot V2 Device and user group. Assigned the proper owner to the dveice group. Added some apps. It worked great. Built a new test tenant and it stopped working. Fails after a hour with an error. Anyone else have issues?

Microsoft Security | Windows Autopilot

1 answer

Sort by: Most helpful
Most helpful Newest Oldest

  1. AI answer

    2026-08-24T16:16:20.2666667+00:00

    Yes. There are several documented Windows Autopilot device preparation issues that match this behavior.

    Most likely checks for a new test tenant:

    1. Verify the device security group owner.
      • The device group used by the Windows Autopilot device preparation policy must have the Intune Provisioning Client service principal as an owner.
      • The required AppID is f1346770-5b25-470b-88bd-d5744ab7952c.
      • In some tenants, this same service principal appears as Intune Autopilot ConfidentialClient. If the AppID matches, it is the correct object.
      • If that service principal does not exist in the tenant, it must be added before it can be used.
    2. Confirm the correct device group is selected in the policy.
      • If the wrong group is referenced, devices are not added correctly and app/script targeting can fail.
    3. Check the device group configuration.
      • Microsoft Entra roles can be assigned to the group must be set to No.
      • The group should not be changed from static to dynamic after the profile is configured.
      • If the owner was removed or the group was deleted/recreated, group membership updates can fail.
    4. Check RBAC permissions for the admin creating the policy.
      • The admin needs Enrollment time device membership assignment RBAC permission.
    5. If apps are the part failing after about an hour, check the deployment report status.
      • If apps or PowerShell scripts show Skipped, that usually means they were selected in the device preparation policy but were not assigned to the device group used by the policy.
      • PowerShell scripts must be configured to run in the System context during OOBE.
    6. Check for the managed installer known issue.
      • If Managed installer policy is active for the tenant, Win32 apps, Microsoft Store apps, and Enterprise App Catalog apps can be skipped during OOBE and install only after the desktop is reached.
      • In the deployment status report, those apps can appear as Skipped.
    7. If the device reaches 100% and appears stuck during OOBE, a manual restart is a documented workaround.

    Because this worked in one tenant and failed in a newly built tenant, the first thing to validate is the service principal ownership on the device group in that new tenant, including whether it appears under the alternate name Intune Autopilot ConfidentialClient.

    AI-generated content may be incorrect. Read our transparency notes for more information.

    Was this answer helpful?

Your answer

Answers can be marked as 'Accepted' by the question author and 'Recommended' by moderators, which helps users know the answer solved the author's problem.