Windows Autopilot self-deploying mode

Note

For more information about using Windows Autopilot to deploy HoloLens 2 devices, see Windows Autopilot for HoloLens 2.

Tip

For a guided walkthrough of Windows Autopilot self-deploying mode, see Step by step tutorial for Windows Autopilot self-deploying mode in Intune.

Windows Autopilot self-deploying mode allows deployment of a device with little user interaction. For devices with an Ethernet connection, no user interaction is required. For devices connected by using Wi-Fi, the user must only:

  • Select the language, locale, and keyboard.
  • Make a network connection.

Self-deploying mode provides all the following features:

  • Joins the device to Microsoft Entra ID.
  • Enrolls the device in Intune or another mobile device management (MDM) service using Microsoft Entra ID for automatic MDM enrollment.
  • Makes sure that all policies, applications, certificates, and networking profiles are provisioned on the device.
  • Uses the Enrollment Status Page to prevent access until the device is fully provisioned.

Note

Windows Autopilot self-deploying mode is only supported for Microsoft Entra join devices. Windows Autopilot self-deploying mode isn't supported for Microsoft Entra hybrid join devices.

Self-deploying mode allows deployment of a Windows device as a kiosk, digital signage device, or a shared device.

Windows Autopilot now has a kiosk mode that supports Kiosk Browser, Microsoft Store apps, and specific versions of Microsoft Edge.

You can use Kiosk Browser to set up a kiosk device. This app is built on Microsoft Edge. Use it to create a tailored, MDM-managed browsing experience.

Automate device configuration by combining self-deploying mode with MDM policies. Use the MDM policies to create a local account configured to automatically sign in. For more information, see:

Optionally, you can use a device-only subscription service that helps manage devices that aren't affiliated with specific users. The Intune device SKU is licensed per device per month.

Note

Intune doesn't automatically configure a primary user when using self-deploying mode in Windows Autopilot to provision a Windows device. Some Intune capabilities rely on a primary user being set on a device. These features include user self-service BitLocker recovery key retrieval and using the Company Portal to install software assigned to users.

Using self-provisioning mode for Windows Autopilot doesn't preclude a licensed user from logging into the device and using features entitled to that user such as Conditional Access. For more information, see Windows Autopilot scenarios and capabilities.

If desired, you can set a primary user manually after device provisioning by using the Intune admin center. For more information, see Change a devices primary user.

Requirements

Important

A device can't automatically re-enroll through Windows Autopilot after an initial deployment with self-deploying mode. Instead, delete the device record in the Microsoft Intune admin center. From the Microsoft Intune admin center, select Devices > All devices > select the devices to delete > Delete. For more information, see Updates to the Windows Autopilot sign-in and deployment experience.

Self-deploying mode uses a device's Trusted Platform Module (TPM) 2.0 hardware to authenticate the device into an organization's Microsoft Entra tenant. Devices without TPM 2.0 can't be used with this mode. Devices must also support TPM device attestation. All new Windows devices should meet these requirements. The TPM attestation process also requires access to a set of HTTPS URLs that are unique for each TPM provider. For more information, see the entry for Windows Autopilot self-Deploying mode and Windows Autopilot pre-provisioning in Networking requirements. For Windows Autopilot software requirements, see Windows Autopilot software requirements.

Important

If you attempt a self-deploying mode deployment on a device that doesn't have support for TPM 2.0 or on a virtual machine, the process fails. When verifying the device, a 0x800705B4 timeout error occurs. This limitation includes Hyper-V virtual TPMs.

To review other known errors and solutions, see Windows Autopilot known issues and Troubleshooting Windows Autopilot device import and enrollment.

You can display an organization-specific logo and organization name during the Windows Autopilot process. To do so, you must configure Microsoft Entra Company Branding with the images and text that need to be displayed. See Quickstart: Add company branding to your sign-in page in Microsoft Entra ID.

Step by step

To deploy in self-deploying mode Windows Autopilot, complete the following preparation steps:

  1. Create a Windows Autopilot profile for self-deploying mode with the settings you want. In Microsoft Intune, this mode is explicitly chosen when creating the profile. It isn't possible to create a profile in the Microsoft Store for Business or Partner Center for self-deploying mode.

  2. If using Intune, create a device group in Microsoft Entra ID and assign the Windows Autopilot profile to that group. Ensure that the profile is assigned to the device before attempting to deploy that device.

  3. Boot the device, connecting it to Wi-Fi if necessary, then wait for the provisioning process to complete.

Validation

When you use Windows Autopilot to deploy in self-deploying mode, the deployment process follows these steps:

  • The device connects to a network and downloads the Windows Autopilot profile.

  • If the device connects through Ethernet and the Windows Autopilot profile is set to skip them, the deployment process doesn't display the following pages:

    • Language and locale
    • Keyboard layout

    Otherwise, the user needs to complete these steps manually:

    • If Windows has multiple preinstalled languages, the user must select a language.
    • The user must select a locale and a keyboard layout, and optionally a second keyboard layout.

  • If the device connects through Ethernet, the deployment process doesn't prompt for a network. If no Ethernet connection is available and the device has built-in Wi-Fi, the user needs to connect to a wireless network.

  • Windows checks for critical out-of-box experience (OOBE) updates. If any updates are available, Windows automatically installs them and reboots if necessary.

  • The device joins Microsoft Entra ID.

  • The device enrolls in Intune or other configured MDM services after it joins Microsoft Entra ID.

  • The deployment process displays the enrollment status page.

  • Depending on the deployed device settings, the device either:

    • Remains at the sign-in screen, where any member of the organization can sign in by providing their Microsoft Entra credentials.
    • Automatically signs in as a local account, for devices configured as a kiosk or digital signage.

Note

Deploying Exchange ActiveSync (EAS) policies by using self-deploying mode for kiosk deployments causes autologon functionality to fail.

If the results you observe don't match these expectations, see Troubleshooting Windows Autopilot overview.

  • Last updated on