Overview
Build an Autopilot deployment that establishes identity, encryption, endpoint protection, and update policy during setup.
Hardware registration and deployment profiles
- Standardize hardware registration through OEM-linked device IDs or reseller registration, rather than manual hash uploads at scale.
- Scope deployment profiles by device use case, such as user-driven, shared, or kiosk, instead of applying one profile organization-wide.
- Confirm the Entra ID join type, Entra joined vs. hybrid joined, is set correctly per profile before devices ship.
Identity and enrollment
- Require Entra ID (or hybrid) join as a condition of profile completion. Don't allow local-account fallback on managed hardware.
- Enforce Enrollment Status Page (ESP) blocking until required apps and policies finish installing, so users can't bypass setup.
- Set a maximum ESP timeout with a defined escalation path for devices that stall during provisioning.
Encryption and endpoint protection baseline
- Enforce BitLocker with TPM-backed key protectors and silent encryption during Autopilot, not as a post-enrollment task.
- Require Microsoft Defender (or equivalent EDR) real-time protection and tamper protection as part of the baseline, verified before the device reaches a compliant state.
- Enforce host firewall policy as part of the same baseline profile, not a separate rollout.
Update policy
- Define update rings by device population, such as pilot, broad, and critical, with staggered deployment deadlines.
- Set feature update deferral separately from quality (security) update deferral. Security patches should move faster.
- Require devices to report update compliance status back to MDM, and alert on devices that fall outside the current ring's deadline.
Rollback and exceptions
- Verify rollback and technician workflows, such as wipe-and-reprovision and White Glove pre-provisioning, without creating unmanaged exceptions.
- Document a path for devices that fail Autopilot provisioning entirely, including how they're re-registered and re-attempted.
- Track any device provisioned outside the standard Autopilot flow as a logged exception, with an owner and remediation deadline.
How to use this resource
Use these considerations to align security, IT, and procurement stakeholders, document current-state gaps, and define measurable acceptance criteria before a rollout. Validate identity and enrollment settings in a pilot ring first: a misconfigured join type or ESP policy is far cheaper to fix before it's applied to the broader fleet.