Windows Autopilot lets a new Windows device pick up your company apps, settings and security policies the moment the employee signs in with their Microsoft account. Use it when you want Windows laptops to arrive ready to configure themselves, with no hands-on setup from IT.

Feature/Functionality

Overview

Before you start, check you have:

• A Microsoft account with the Global Administrator role on your Entra tenant.
• A licence covering both Microsoft Entra ID Plan 1 (or Plan 2) and Windows Autopilot. The cheapest licence that includes both is Enterprise Mobility + Security E3 (compare plans).
• Your MDM address, {company}.mdm.getprimo.com, and in particular its {company} subdomain. If you do not know it, write to support@factorial.it.

Things to know about how Autopilot devices behave:

• They use Entra accounts, not local accounts. Microsoft is gradually phasing local accounts out in favour of Entra.
• Your Entra administrator decides whether employees get standard or administrator rights. Anyone with the Global Administrator role in Entra becomes an administrator on every Autopilot device they sign in to.
• The device must be online at first boot so it can authenticate with Entra.

How to use 

Set up zero-touch

The setup has five steps. The first three match the three steps of the Add Windows Autopilot window in the console. To open it, go to MDM > Settings, click Windows under Platforms, then click Add under Windows Autopilot. If you already started, click Finish setup instead. Work through them in order: each step unlocks the next one. Steps 4 and 5 happen afterwards, in the Microsoft consoles only.

Step 3 needs three values from Entra: your Tenant ID, the Application (client) ID of the Fleet application, and the Primary domain your employees use to sign in. You collect them as you go and paste them into the console yourself. The only thing you send to support is the domain verification code in step 2.

Step 1. Connect Microsoft Entra.

You need an Entra user with the Global Administrator role, plus permission to manage SaaS in Factorial IT. You do not register any application yourself: you give consent to an application that already exists in Microsoft's directory.

Autopilot devices sign in with Entra credentials rather than separate usernames and passwords, so Entra comes first. Steps 2 and 3 stay locked until this connection is live.

1. Open the Add Windows Autopilot window from MDM > Settings > Windows.
2. In step 1, click Connect Microsoft Entra.
3. Sign in with your Global Administrator account and accept the permissions on Microsoft's consent screen. Accounts without that role cannot grant them.
4. You land back in the Windows Autopilot setup. Step 1 now shows Connected to followed by your Entra instance, and step 2 opens.

If Entra is already connected under SaaS, step 1 lists it. Click Use this one next to the instance you want, or Connect another one.

Connecting here adds Microsoft Entra to your connected SaaS at no extra cost. Factorial IT only reads your Entra users and groups. It creates no rule and does not turn Entra into your email provider. Set Entra as email provider is a separate choice: it creates each new employee's work email address during onboarding. Read "Connect your email provider" before you change it.

If the connection fails or you cancel it, an error appears above the button in step 1. Make sure you signed in as a Global Administrator, then try again.

Step 2. Declare the Fleet domain.

The Fleet domain is your MDM address, {company}.mdm.getprimo.com. It is not your company's email domain; that one is used in step 3.

This step needs support. Microsoft gives you a verification code, and only the support team can add it to the DNS. Allow up to 2 business days once you have sent it.

1. Sign in to Microsoft Azure as an administrator.
2. Open Domain names and click + Add custom domain.
3. Type {company}.mdm.getprimo.com and click Add domain.
4. Copy the Destination or routing address (it looks like MS=ms12345678) and send it to support@factorial.it.
5. When support confirms, click Verify.

Step 3. Connect Azure and Fleet.

Two of the three values in step 3 come from a Fleet application you now create in Entra. The third is the domain your employees sign in with.

Create the Fleet application

1. Go to Mobility (MDM and WIP), click + Add application > + Create your own application, name it Fleet (this guide uses that name throughout) and click Create.
2. Enter the two MDM URLs, swapping {company} for your subdomain, then click Save:

   https://{company}.mdm.getprimo.com/api/mdm/microsoft/tos

   https://{company}.mdm.getprimo.com/api/mdm/microsoft/discovery

3. Click Custom MDM application settings, then the link under Application ID URI, then Edit. Enter https://{company}.mdm.getprimo.com and click Save.
4. From the left menu, open API permissions > + Add a permission > Microsoft Graph. Add these under Delegated permissions:

   Group.Read.All
   Group.ReadWrite.All

5. Add these under Application permissions:

   Device.Read.All
   Device.ReadWrite.All
   Directory.Read.All
   Group.Read.All
   User.Read.All

6. Click Grant admin consent for {Your Company}.

Make Fleet the default MDM for new devices

1. Go back to Mobility (MDM and WIP).
2. Click Microsoft Intune, set both MDM user scope and WIP user scope to None, and click Save.
3. Click Fleet, set MDM user scope to All, and click Save.

Any device already enrolled through Intune before this change has to be migrated by you (see "Silent agent deployment", section on migrating from another MDM). If you skip it, those devices stay half-configured and employees notice.

Paste the connection values into the console

Factorial IT authenticates to your tenant with three Entra values. You type them into step 3 of the window and they are applied automatically; nothing goes to support. Until all three are saved, the console shows a token alert banner and Windows zero-touch does not fully work. This also applies to tenants set up before step 3 existed.

In MDM > Settings > Windows, click Finish setup on your Windows Autopilot setup, fill in the three fields of step 3 and click Save.

Two easy mistakes:

• Domain means your employees' sign-in domain (company.com), not the MDM domain from step 2.
• Both IDs are GUIDs and look alike. Read the label before you paste: the Tenant ID points to your Entra tenant, the client ID to the Fleet application.

Step 4. Create Autopilot deployment profiles.

A deployment profile sets the defaults for devices that come in through Autopilot, for example the account type (Administrator or Standard), the default country and keyboard language, and the naming pattern ({company}-%RAND:5% gives {company}-23456). Microsoft's profile documentation has the full list.

1. Create the profile. In Microsoft Intune, open Devices > Enrollment > Deployment Profiles, click + Create profile and go through the three screens: name, deployment mode, assignment.
2. Create a dynamic device group. In portal.azure.com, click + Create group, give it a name such as "Windows Autopilot devices", pick Dynamic devices and use this rule:

   (device.devicePhysicalIds -any (_ -startsWith "[ZTDid]"))

3. Create an Enrollment Status Page. In Microsoft Intune, open Devices > Enrollment > Enrollment Status Page, click + Create, name it, switch on the progress display and assign it to your dynamic group.

Step 5. Add your company branding.

The logo you upload shows on the Autopilot sign-in screen beside the title Welcome to {Your Company}!. Seeing it is also the fastest proof that a device really went through Autopilot at first boot.

1. Sign in to Microsoft Azure, search for Company branding and click Configure (or Edit if a default sign-in experience exists).
2. On the Sign-in form tab, upload your logo to both Square logo (light theme) and Square logo (dark theme).
3. Click Review + save, then Save.

Register your devices in Autopilot

A deployment profile only reaches devices that are registered in Autopilot. Registering is not enrolling: it ties the device's hardware identity to your Entra tenant, so Windows recognises it at first boot and starts the Autopilot flow.

Devices bought through Factorial IT are registered for you by the accredited resellers (see "Set up zero-touch deployment on your catalogue"). The steps below are only for devices you bought elsewhere.

1. Export the hardware hash. On the device, open PowerShell as an administrator and run:

New-Item -Type Directory -Path "C:\HWID"
Set-Location -Path "C:\HWID"
$env:Path += ";C:\Program Files\WindowsPowerShell\Scripts"
Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo -OutputFile AutopilotHWID.csv

You get a CSV file with the hardware hash. Microsoft documents other ways to export it.

2. Import the CSV into Intune.

1. In Microsoft Intune, open Devices > Enrollment > Windows Autopilot > Devices.
2. Click Import and upload the CSV. It takes a few minutes; refresh until the device appears.
3. Check that Profile status says Assigned. If it stays on Not assigned, review how your deployment profile is assigned (step 4).

What the employee sees

When a new employee gets a device registered in Autopilot, they:

1. Turn it on.
2. Pick their country, language and keyboard layout.
3. Connect to the internet.
4. Sign in with their Microsoft credentials, plus multi-factor authentication if you have it switched on.
5. Set a PIN, and a fingerprint if the hardware has a reader.
6. Start working. The apps and controls you defined in the console apply on their own.

Test the enrolment

Try the whole flow on one registered device before rolling it out to everyone.

1. Reset the test device (Settings > System > Recovery > Reset this PC) or reimage it.
2. Switch it on, choose country and keyboard, and connect to the internet.
3. Check the sign-in screen says Welcome to {Your Company}! with your logo. That proves the device went through Autopilot.
4. Sign in with a test employee's Entra account. Windows then asks for a PIN (Windows Hello), and a fingerprint if supported.
5. When the desktop appears, check the device shows up in Devices in the console and receives your apps and policies.

Devices not registered in Autopilot can still enrol on their own. During Windows setup, choose Set up for work or school and sign in with Entra. The device enrols in Factorial IT but skips the branded Autopilot screens and the Enrollment Status Page.

Reset or reassign a device

When a device moves to someone else (offboarding, replacement, reuse), clear its old records so Autopilot treats it like a new device.

1. Wipe it. Send a remote wipe from the console, or reset it locally from Settings > System > Recovery > Reset this PC.
2. Delete the old device record. You cannot delete an enrolled device, so unenrol it first with Actions > Unenroll (or Mark as unenrolled if it is offline). Then, on the device page, click Actions > Delete and confirm. The next enrolment starts with a clean record.
3. Clean up Entra. In Microsoft Azure, go to Devices > All devices and delete the stale object for the wiped device.
4. Sync Autopilot. In Microsoft Intune, open Devices > Enrollment > Windows Autopilot > Devices. Check the device is still there with Profile status Assigned, click Sync and wait until it finishes. Never delete the device from this list: the registration has to survive the wipe.
5. Boot the device. The branded welcome screen confirms Autopilot has picked it up. If it skips Autopilot, wait a few minutes and restart: Microsoft may still be processing the clean-up.

Troubleshooting and FAQ

Troubleshooting

• Steps 2 and 3 stay locked. The Entra connection in step 1 is not active yet. Finish it first.
• Step 1 shows an error above the button. The connection failed or was cancelled. Make sure you signed in with a Global Administrator account and try again.
• The console shows a token alert banner. One or more of the three step 3 values is missing. Open Finish setup, fill in all three and click Save.
• Profile status stays on Not assigned. The deployment profile is not assigned to the device. Review its assignment and your dynamic device group.
• The device does not show the branded welcome screen. It is probably not registered in Autopilot, or the registration has not synced yet. Check Windows Autopilot > Devices in Intune, sync, wait a few minutes and restart.
• Devices previously in Intune behave inconsistently. They were not migrated before Fleet became the default MDM. Migrate them.

FAQ

1. Do I need to register an application of my own for step 1?
   No. You give consent to an application that already exists in Microsoft's directory. You only create the Fleet application, in step 3.
    
2. Does connecting Entra make it my email provider?
   No. Factorial IT only reads users and groups. Set Entra as email provider is a separate setting.
    
3. What is the difference between the Fleet domain and the Domain field?
   The Fleet domain is your MDM address, declared in step 2. The Domain field in step 3 is the domain your employees sign in with, such as company.com.
    
4. Can a device enrol automatically if it is not registered in Autopilot?
   Yes. The employee chooses Set up for work or school and signs in with Entra. It skips the branded screens and the Enrollment Status Page.
    
5. Will employees be administrators on their devices?
   That depends on how your Entra administrator configures it. Global Administrators in Entra are always administrators on Autopilot devices they sign in to.
    
6. Do I need to register devices bought through Factorial IT?
   No. The accredited resellers register them. Only devices bought elsewhere need the hardware hash import.