Workplace
Rolling out laptops with Intune and Autopilot: how does it work?
Short answer
With Windows Autopilot you register a laptop with your organisation in advance. When an employee switches it on and signs in with their work account, the laptop fetches its settings, apps and security from Microsoft Intune over the internet. Nobody has to come round with an image. You need Windows Pro or higher and a licence with Intune and Entra ID P1, such as Microsoft 365 Business Premium.
What do Autopilot and Intune actually do?
They are two parts that work together.
Windows Autopilot makes sure a laptop knows which organisation it belongs to the first time it starts. Microsoft Intune is the management portal: it holds the settings, apps and security rules the laptop fetches. Together they replace the old routine of building an image, setting the laptop up at the office and then handing it over.
The result: a laptop can go in the supplier’s box to an employee at home, and set itself up there.
How does a laptop get into Autopilot?
Every laptop has a hardware hash, a kind of fingerprint. It has to be in Intune before Autopilot does anything. There are two routes.
- Through the supplier. Many suppliers and manufacturers register new laptops for you, at the time you order. This is the route Microsoft recommends for new devices.
- Yourself. For a laptop already in use, you read the hash with a PowerShell script, through the Windows settings or through the diagnostics page during setup. You import it into Intune as a CSV file.
Then you assign an Autopilot profile: how setup goes, what the employee does and does not see, and what name the laptop gets.
Which licence do you need?
Two things: Windows Pro or higher on the laptop, and a subscription with Intune and Entra ID P1.
| Subscription | Intune and Entra ID P1 |
|---|---|
| Microsoft 365 Business Premium | Yes |
| Microsoft 365 E3 and E5 | Yes |
| Microsoft 365 Business Basic or Standard | No, add them separately |
Windows Home is not supported. If you buy laptops for business use, check the Windows edition.
What does the employee see?
Not much, and that is the point. The laptop asks for language, keyboard and wifi. Then your organisation’s sign-in screen appears. The employee signs in with their own work account, and a status page shows what is happening: security, settings, apps.
You can set the laptop so it can only be used once all required apps and settings are in place. That prevents someone starting work on a laptop without encryption or without Office.
What does Intune set up?
Everything you used to do by hand, and now record once:
- Apps, such as Microsoft 365 Apps, Teams, a PDF reader and your own business software
- BitLocker encryption of the disk, without the employee having to do anything, with the recovery key stored safely in Entra ID
- Wifi profiles and VPN
- Update policy for Windows
- Rules for passwords, screen lock and Windows Hello
- What an employee may install themselves
Because the policy lives centrally, laptop thirty is set up exactly like laptop one. Rolling out thirty laptops in one day is perfectly doable that way.
What goes wrong in practice?
Usually not Autopilot itself, but what surrounds it.
- A user without a licence. Setup then gets stuck on the status page.
- Apps getting in each other’s way. Two installs at once, or an app that restarts the laptop by itself, can make setup stall. You test this on one laptop first.
- A network that blocks too much. Autopilot needs internet access and talks to Microsoft services. A strict firewall or a guest network with a login page can block that.
- Laptops already registered to another organisation. This happens with second-hand or returned devices. The previous owner has to release them first.
- The wrong Windows edition. Home instead of Pro.
How do we approach it?
We set up Intune and Autopilot, test it on one laptop, and then roll out. After the rollout you manage things yourself, or we agree on management. More under workplace and collaboration. Not sure Microsoft 365 is the right fit? Read Nextcloud or Microsoft 365 as well.