Deploy laptops with Intune, without recreating the task sequence.

Step 1

Choose the deployment route before opening the portal.

Windows Autopilot and Windows Autopilot device preparation are related Microsoft services with different requirements. Confirm which one your tenant and Windows version support before following a tutorial.

Step 2

Prepare the tenant and the safety boundary.

1. 1

   Confirm licensing, roles and MDM authority

   Use a dedicated pilot administrator with the least privilege available. Confirm users and devices have the required Microsoft licences.

2. 2

   Configure automatic Intune enrolment

   Start with a small pilot group, not every user. Confirm that Microsoft Entra join and enrolment restrictions match school ownership rules.

3. 3

   Build groups with visible purpose

   Separate staff 1:1, shared pupil, kiosk, IT pilot and exception devices. Use group tags/order identifiers consistently and document who owns each assignment.

4. 4

   Lay down the minimum viable policy set

   Identity, BitLocker recovery, Defender, firewall, Windows LAPS, update rings, compliance, browser and Wi-Fi/VPN or certificates where required. Avoid duplicate settings across several profiles.

5. 5

   Package only what blocks first use

   Keep the Enrollment Status Page list short: identity and genuinely required applications. Let non-essential software arrive after the desktop is usable.

6. 6

   Test the complete user journey

   Use representative hardware and a representative non-administrator account. Test first sign-in, applications, printing, files, safeguarding tools, recovery key escrow, updates, reset and handover.

Step 3

Translate the old estate; do not copy it blindly.

Step 4

Ask Dell or HP to register new devices before delivery.

Dell documents an OEM partner invitation and tenant-domain onboarding route. HP offers Windows Autopilot enablement and pre-provisioning services; availability and commercial process vary by region and agreement. The manufacturer registers hardware identity with the Autopilot service—it does not need continuing administrative access to manage your tenant.

Step 5

Use PowerShell for evidence and registration, not guesswork.

These examples use built-in Windows commands or Microsoft’s published Autopilot script. They are syntax-checked and intentionally avoid reset, wipe, deletion and tenant-wide change. Run on a test device first and read every line.

$computer = Get-CimInstance -ClassName Win32_ComputerSystem
$bios = Get-CimInstance -ClassName Win32_BIOS

[pscustomobject]@{
  Manufacturer = $computer.Manufacturer
  Model        = $computer.Model
  SerialNumber = $bios.SerialNumber
  BIOSVersion  = $bios.SMBIOSBIOSVersion
}

dsregcmd.exe /status

$Target = 'C:\HWID'
New-Item -ItemType Directory -Path $Target -Force | Out-Null
Set-Location -Path $Target

[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
$ScriptPath = Join-Path $env:ProgramFiles 'WindowsPowerShell\Scripts'
if ($env:Path -notlike "*$ScriptPath*") { $env:Path += ";$ScriptPath" }

Set-ExecutionPolicy -Scope Process -ExecutionPolicy RemoteSigned -Force
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo.ps1 -OutputFile "$Target\AutopilotHWID.csv"

Get-Item "$Target\AutopilotHWID.csv" |
  Select-Object FullName, Length, LastWriteTime

$Targets = @(
  'ztd.dds.microsoft.com',
  'login.microsoftonline.com',
  'enrollment.manage.microsoft.com'
)

foreach ($Target in $Targets) {
  Resolve-DnsName -Name $Target -ErrorAction Continue
  Test-NetConnection -ComputerName $Target -Port 443
}

w32tm.exe /query /status

$Output = Join-Path $env:PUBLIC 'Documents\MDMDiagReport.zip'

& "$env:SystemRoot\System32\mdmdiagnosticstool.exe" -area "DeviceEnrollment;DeviceProvisioning;Autopilot" -zip $Output

Get-Item $Output | Select-Object FullName, Length, LastWriteTime

$LogNames = @(
  'Microsoft-Windows-ModernDeployment-Diagnostics-Provider/Autopilot',
  'Microsoft-Windows-DeviceManagement-Enterprise-Diagnostics-Provider/Admin'
)

foreach ($LogName in $LogNames) {
  Get-WinEvent -LogName $LogName -MaxEvents 50 -ErrorAction SilentlyContinue |
    Select-Object @{Name='Log';Expression={$LogName}},
      TimeCreated, Id, LevelDisplayName, Message
}

Step 6

Troubleshoot the failed stage, not “Intune” as one thing.