By Hardeip Singh, Solutions Lead and Technical Pre-Sales Architect at Auxilion
Most organisations I speak to have the same goal: a new laptop arrives, the user signs in, and ten minutes later they are working. What differs is how much effort IT spends getting there, and how much risk lands on the user's desk.
After more than twenty years in enterprise endpoint, identity and cloud work, I have seen Windows Autopilot done well and done badly. Two decisions separate the two: which join model you choose, and how your devices are delivered.
What is Autopilot?
Windows Autopilot is a Microsoft service that sets up Windows devices so that they configure themselves when the user signs in, instead of IT building each one by hand. Apps, security settings and policy are delivered through Intune, Microsoft's device management service, and the user's identity lives in Entra ID, Microsoft's cloud identity service. With pre-provisioning, the device arrives compliant and the user only signs in.
Entra join or Hybrid join?
Entra join is cloud-native. The device needs no line of sight to a domain controller, apps and policy come from Intune, and it suits remote-first users and new builds. It is the direction Microsoft is heading, and it should be your default.
Entra hybrid join registers the device in both Active Directory (AD) and Entra ID. It remains the right answer where you still depend on Group Policy, legacy Kerberos or NTLM, or on-premises file and print. The trade-off is that the device must reach a domain controller during setup, on the LAN or over VPN.
My advice is simple: choose Entra join unless you can name the AD dependency that rules it out.
Five ways to deliver devices
How devices are enrolled and pre-provisioned matters as much as the join type. Pre-provisioning means the device build is completed before it reaches the user. OEM below means the hardware manufacturer or reseller. These are the five scenarios I walk customers through:
- Local IT enrols, no pre-provisioning. Workable for small estates. The cost is a manual unbox-and-enrol step for every device, and the user receives a device with no compliance applied until it reaches the network and signs in.
- OEM enrols, no pre-provisioning. The device is already registered, but the user still waits for apps and settings after sign-in, and a failure leaves them stuck.
- OEM enrols, local IT pre-provisions and reseals. Security improves, but IT must unbox every device and needs enough network capacity for the daily build volume.
- OEM enrols and pre-provisions. In my experience, this is the best fit for mid-size and large organisations. The device arrives compliant, the user only signs in, and IT does not need a large build team. It needs a more accurate setup and a larger upfront spend, but it costs less over time.
- Local IT enrols and pre-provisions. The user experience matches scenario 4, but all the effort sits with IT, and it becomes expensive as volumes grow.
Whichever route your vendor uses, the customer side is similar: give the vendor your Microsoft tenant details, agree the group tag format per order, and put the tag on the purchase order. A group tag is a label on each device record that decides which build profile it receives.
What the users see
With pre-provisioning, the technician (or OEM) completes the device phase and reseals the device. The user then goes through language, region and keyboard, connects to a network, signs in on the company-branded screen, completes multi-factor authentication (MFA), and lands on a desktop with their apps in place.
Expect roughly 10 to 20 minutes for a pre-provisioned device and 30 to 90 minutes for a fresh out-of-box build. Tell users to stay on power and keep the lid open, and send a one-page guide with the device.
Common Hybrid build mistakes and how to avoid them
Most failed hybrid builds trace back to the same four causes, and each has a plain fix:
- Missing permissions. Use a dedicated location in Active Directory for Autopilot devices, and give the connector, the tool that creates device accounts in Active Directory, the right permissions on it.
- No route to a domain controller. The device must reach one during setup, on the LAN or over VPN.
- Sync scope. Make sure that location is included when Entra Connect syncs Active Directory to Entra ID.
- Tag and profile mismatch. Keep it simple: one tag, one profile and one dynamic group, which is a group that collects devices automatically by their tag.
A pilot ring before broad rollout catches most issues like these.
Frequently asked questions
How long does a new Autopilot device take to set up for the user?
It depends on how the device was delivered. Expect roughly 10 to 20 minutes for a pre-provisioned device, where the build was completed before it reached the user, and 30 to 90 minutes for a fresh out-of-box build. Tell users to stay on power and keep the lid open.
What should we check before devices ship?
Before a batch of devices ships, check three things: that each serial number is listed with the correct group tag, which decides the build profile the device receives; that the profile status is Assigned; and that the dynamic group, the automatic group that collects devices by their tag, has populated. Audit new devices weekly.
What should we do before a wider rollout?
Run a pilot ring first: a small group of devices and users that goes through the build before everyone else. It catches most of the issues behind failed builds, such as missing permissions, no route to a domain controller, sync scope and tag mismatches.
Need a hand?
I'm Hardeip, Solutions Lead and Technical Pre-Sales Architect at Auxilion, an Ireland-based technology and managed services company. If you are planning an Autopilot rollout, moving from hybrid join to Entra join, or tidying up an Intune environment that has grown organically, I'm glad to talk it through, and Auxilion can help with design, build and ongoing support.
Connect with Auxilion: auxilion.com, or hello@auxilion.com for general enquiries
