{"id":520693,"date":"2026-04-08T08:08:59","date_gmt":"2026-04-08T15:08:59","guid":{"rendered":"https:\/\/jorgep.com\/blog\/?p=520693"},"modified":"2026-05-13T08:15:43","modified_gmt":"2026-05-13T15:15:43","slug":"windows-autopilot-v2-device-preparation-how-to-do-it","status":"publish","type":"post","link":"https:\/\/jorgep.com\/blog\/windows-autopilot-v2-device-preparation-how-to-do-it\/","title":{"rendered":"Windows Autopilot v2 (Device Preparation) How to do it"},"content":{"rendered":"\n<p><\/p>\n\n\n\n<p>Checkout my other blogs about <a href=\"https:\/\/jorgep.com\/blog\/tag\/windows-autopilot\/\">Windows Autopilot <\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>Windows Autopilot device preparation (sometimes called V2 or &#8220;next-gen&#8221; Autopilot) in Microsoft Intune streamlines deployment by allowing IT to pre-configure apps, settings, and security policies , resulting in faster user-driven Microsoft Entra joins without needing hardware hash uploads. <\/p>\n\n\n\n<p><\/p>\n\n\n\n<p>Please see: <a href=\"https:\/\/jorgep.com\/blog\/windows-autopilot-moving-to-v2-device-preparation\/\" data-type=\"post\" data-id=\"520688\">Windows Autopilot: Moving to v2 (Device Preparation)<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The Primary Question: Do Devices Need to be Pre-Registered?<\/h3>\n\n\n\n<p><\/p>\n\n\n\n<p>Short Answer: <strong>No, devices do not need to be pre-registered<\/strong> with their hardware hashes to use Windows Autopilot device preparation.<\/p>\n\n\n\n<p>Eliminating pre-registration is the primary structural change of this next-generation deployment fr<\/p>\n\n\n\n<p>amework<\/p>\n\n\n\n<p><strong>The typical follow-up Question is can Autopilot v1 and Device Preparation (v2) coexists?<\/strong><\/p>\n\n\n\n<p>The short answer is&nbsp;<strong>yes<\/strong>. You do not need to switch your entire organization to v2 overnight. Many enterprises are currently running both versions simultaneously.  However there  is a couple of caveats to be aware of: <\/p>\n\n\n\n<p>Important Note: If you want a device to use the new v2 experience, you must ensure its hardware hash has been deleted from (or was never uploaded to) the classic Autopilot registration list.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"903\" height=\"200\" src=\"https:\/\/jorgep.com\/blog\/wp-content\/uploads\/image-160.png\" alt=\"\" class=\"wp-image-520695\" srcset=\"https:\/\/jorgep.com\/blog\/wp-content\/uploads\/image-160.png 903w, https:\/\/jorgep.com\/blog\/wp-content\/uploads\/image-160-300x66.png 300w, https:\/\/jorgep.com\/blog\/wp-content\/uploads\/image-160-768x170.png 768w\" sizes=\"auto, (max-width: 903px) 100vw, 903px\" \/><\/figure>\n\n\n\n<p>More details on this:    <a href=\"https:\/\/jorgep.com\/blog\/windows-autopilot-moving-to-v2-device-preparation\/\" data-type=\"post\" data-id=\"520688\">Windows Autopilot: Moving to v2 (Device Preparation)<\/a><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How It Works Without Registration<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>User-Centric Trigger:<\/strong> Instead of tracking device identity, policies target <strong>user groups<\/strong>. When an assigned user signs into a new or reset machine during the Out-of-Box Experience (OOBE), the deployment begins automatically.<\/li>\n\n\n\n<li><strong>Dynamic Grouping:<\/strong> Once the user authenticates, the system automatically adds that specific hardware to your designated Intune device group.<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>Important Caveats<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Do Not Pre-Register:<\/strong> If a device is already registered or added to classic Windows Autopilot via hardware hash, the legacy Autopilot profile will take priority, and device preparation policies will fail.<\/li>\n\n\n\n<li><strong>Personal vs. Corporate Enrollment:<\/strong> Because there is no hardware hash verification, Intune cannot natively distinguish personal machines from corporate ones at first boot.<\/li>\n\n\n\n<li><strong>Corporate Identifiers (Optional Security):<\/strong> If you use <a href=\"https:\/\/learn.microsoft.com\/en-us\/autopilot\/device-preparation\/overview\" target=\"_blank\" rel=\"noreferrer noopener\">Intune enrollment restrictions<\/a> to block personal devices from joining, you must pre-upload the device&#8217;s basic corporate identifiers (Serial Number, Manufacturer, and Model) so Intune recognizes it as corporate property. This still avoids the tedious process of harvesting complex hardware hashes<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">How does it know it is a corporate device without pre-registration?<\/h3>\n\n\n\n<div class=\"wp-block-group\"><div class=\"wp-block-group__inner-container is-layout-constrained wp-block-group-is-layout-constrained\">\n<p>Behind the scenes, the process uses a shift in logic from traditional Autopilot. In classic Autopilot, the <strong>device&#8217;s hardware hash<\/strong> tells the OOBE screen which company it belongs to <em>before<\/em> anyone logs in. <\/p>\n\n\n\n<p>With next-generation <strong>Device Preparation<\/strong>, the device actually starts as a standard, generic Windows setup. The mechanism that links it to your organization occurs dynamically through the following sequence: <\/p>\n\n\n\n<p><strong>1. The Generic &#8220;Work or School&#8221; Prompt<\/strong><\/p>\n\n\n\n<p>When a new device boots, it displays a standard Windows login screen asking for a Microsoft account.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li class=\"has-theme-palette-14-color has-text-color has-link-color wp-elements-d0cecde524b5f3172d6b13760c9d1fd5\"><em>To trigger the corporate flow, the user must select <strong>&#8220;Set up for work or school&#8221;<\/strong>.<\/em><\/li>\n\n\n\n<li>As soon as they type their corporate email suffix (e.g., <code>user@yourcompany.com<\/code>), Windows reads the domain name. <\/li>\n<\/ul>\n\n\n\n<p><strong>2. Tenant Redirection &amp; Branding Lookup<\/strong><\/p>\n\n\n\n<p>The moment the domain suffix is typed, Windows pauses and queries the global Microsoft Entra ID cloud authentication service (<code>microsoftonline.com<\/code>).<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Entra ID locates your corporate tenant based on that domain name.<\/li>\n\n\n\n<li>It instantly pushes your organization&#8217;s custom branding, logos, and specific login page formatting down to that local OOBE screen. <\/li>\n<\/ul>\n\n\n\n<p><strong>3. User Authentication &amp; Policy Check<\/strong><\/p>\n\n\n\n<p>The user completes their sign-in and passes any corporate Multi-Factor Authentication (MFA) requirements. After authentication succeeds: <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Entra ID checks if that specific user account belongs to an <strong>assigned user group<\/strong> targeted by an Intune Device Preparation policy.<\/li>\n\n\n\n<li>If a policy matches, the Entra ID join token hands off instruction URLs directly to the local Windows MDM agent.<\/li>\n<\/ul>\n\n\n\n<p><strong>4. Just-In-Time (JIT) Device Registration<\/strong><\/p>\n\n\n\n<p>The local machine registers itself into your corporate Entra ID. <\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Simultaneously, the <strong>Intune Provisioning Client<\/strong> service principal intercepts the new device ID.<\/li>\n\n\n\n<li>It instantly assigns the machine into the backend <strong>Assigned Security Device Group<\/strong> you created during setup.<\/li>\n\n\n\n<li>The policy configurations, tracked apps, and scripts assigned to that group are pulled down instantly, throwing up the Device Preparation progress screen<\/li>\n<\/ul>\n\n\n\n<p><\/p>\n<\/div><\/div>\n\n\n\n<h3 class=\"wp-block-heading\">Step-by-Step User Experience<\/h3>\n\n\n\n<p>From the user&#8217;s perspective, the process is streamlined and mirrors a standard consumer Windows setup, with corporate enrollment happening automatically in the background.<\/p>\n\n\n\n<p><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Unbox and Power On:<\/strong> The user unboxes the brand-new (or factory-reset) Windows device and turns it on.<\/li>\n\n\n\n<li><strong>Basic Region &amp; Keyboard Selection:<\/strong> The device boots into the Windows Out-of-Box Experience (OOBE). The user selects their <strong>Region<\/strong> and <strong>Keyboard layout<\/strong>, then connects to a <strong>Wi-Fi or wired network<\/strong>.<\/li>\n\n\n\n<li><strong>Corporate Sign-In:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Instead of a generic Microsoft account prompt, a branded corporate login screen appears once the network connection is established.<\/li>\n\n\n\n<li>The user types in their full <strong>corporate email address<\/strong> and password.<\/li>\n\n\n\n<li>They complete any required <strong>Multi-Factor Authentication (MFA)<\/strong> prompts.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Device Preparation Screen:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Immediately after authentication, a full-screen progress page appears.<\/li>\n\n\n\n<li>The user sees a clear, real-time status tracker divided into three main phases: <strong>Setting up your device<\/strong>, <strong>Installing apps<\/strong>, and <strong>Applying security policies<\/strong>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Desktop Readiness:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Once the tracked apps (up to 10) and scripts complete their installation, the setup screen finishes.<\/li>\n\n\n\n<li>The user is immediately logged into the Windows desktop.<\/li>\n\n\n\n<li>Their primary business applications, security baselines, and configurations are already active and ready for immediate use.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Steps to Configure Device Preparation Policies (2026)<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Create a Device Group:<\/strong> Navigate to Microsoft Intune admin center > <strong>Groups<\/strong> > <strong>New group<\/strong>. Create an assigned device group (empty) that will be populated by devices during onboarding.<\/li>\n\n\n\n<li><strong>Assign Provisioning Client:<\/strong> For the created group, ensure the Intune Provisioning Client service principal is the owner, or follow MS instructions to ensure the app ID exists in your tenant.<\/li>\n\n\n\n<li><strong>Create the Policy:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Go to <strong>Devices<\/strong> > <strong>Windows<\/strong> > <strong>Device onboarding<\/strong> > <strong>Enrollment<\/strong>.<\/li>\n\n\n\n<li>Under <strong>Windows Autopilot device preparation<\/strong>, click <strong>Device preparation policies<\/strong> > <strong>+ Create<\/strong>.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Configure Policy Settings:<\/strong>\n<ul class=\"wp-block-list\">\n<li>Select <strong>User-driven<\/strong> deployment.<\/li>\n\n\n\n<li>Name the policy (e.g., &#8220;Autopilot Device Prep&#8221;).<\/li>\n\n\n\n<li>Assign the device group created in Step 1.<\/li>\n\n\n\n<li><strong>Configuration Settings:<\/strong> Choose apps (up to 10) and scripts (up to 10) to install during the process.<\/li>\n\n\n\n<li><strong>Review and Create<\/strong> the policy.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Assign User Group:<\/strong> Assign the policy to a user group (e.g., Azure AD group of users receiving devices).<\/li>\n<\/ol>\n\n\n\n<p><strong>Key Considerations<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Conflict:<\/strong> If a device is registered in classic Windows Autopilot, it cannot use Device Preparation, as the old policy takes priority.<\/li>\n\n\n\n<li><strong>Requirements:<\/strong> Requires Automatic Intune enrollment to be enabled.<\/li>\n\n\n\n<li><strong>Monitoring:<\/strong> Monitor progress in <strong>Devices<\/strong> > <strong>Monitor<\/strong> > <strong>Windows Autopilot device preparation deployments<\/strong>.<\/li>\n\n\n\n<li><strong>Best Practice:<\/strong> Use this for new device setups to streamline app installations before the user hits the desktop.<\/li>\n<\/ul>\n\n\n\n<h3 class=\"wp-block-heading\">Corporate Identifier List in Microsoft Intune <\/h3>\n\n\n\n<p>The Corporate Identifier List in Microsoft Intune <strong>is an optional security f<\/strong>eature that allows IT administrators to pre-register company-owned devices (Windows, iOS\/iPadOS, Android) by importing a CSV file containing unique device identifiers like serial numbers or IMEI. This list ensures devices are marked as &#8220;Corporate&#8221; upon enrollment, enabling automatic policy application and restricting personal device access. <\/p>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>Key Aspects of Corporate Identifiers<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Purpose:<\/strong> Distinguishes corporate-owned devices from personal (BYOD) devices to apply specific security policies, automate enrollment, and prevent unauthorized access.<\/li>\n\n\n\n<li><strong>Supported Platforms:<\/strong> Windows 10\/11, iOS\/iPadOS, and Android.<\/li>\n\n\n\n<li><strong>Windows Requirements:<\/strong> Requires a CSV file containing Manufacturer, Model, and Serial Number, typically for devices running Windows 10 KB5039299 (Build 19045.4598) or later.<\/li>\n\n\n\n<li><strong>Mobile\/iOS Requirements:<\/strong> Uses IMEI or Serial Number.<\/li>\n\n\n\n<li><strong>Management:<\/strong> Administrators can add these identifiers in the <a href=\"https:\/\/learn.microsoft.com\/en-us\/intune\/device-enrollment\/add-corporate-identifiers\" target=\"_blank\" rel=\"noreferrer noopener\">Microsoft Intune admin center<\/a> under Devices > Enrollment > Corporate device identifiers. <\/li>\n<\/ul>\n\n\n\n<p><strong>How It Works<\/strong><br>When a device is enrolled, Intune checks if its identifier matches the pre-uploaded list. If a match is found, the device is immediately categorized as corporate-owned, bypassing restrictions that might block unknown devices. For Windows devices, this is particularly useful in conjunction with Windows Autopilot to ensure only authorized hardware enters the production environment<\/p>\n\n\n\n<p><strong>When You Can Skip It<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>BYOD Environments:<\/strong> You do not need it if users enroll personal devices.<\/li>\n\n\n\n<li><strong>Alternative Methods:<\/strong> You use other automated corporate enrollment methods.<\/li>\n\n\n\n<li><strong>Examples:<\/strong> Apple Automated Device Enrollment (ADE), Android Enterprise, or standard Windows Autopilot.<\/li>\n<\/ul>\n\n\n\n<p><strong>What Happens Without It<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Default Tagging:<\/strong> Enrolled devices are automatically marked as &#8220;Personal&#8221; by default.<\/li>\n\n\n\n<li><strong>Manual Changes:<\/strong> Admins must manually switch the ownership tag to &#8220;Corporate&#8221; later.<\/li>\n\n\n\n<li><strong>Policy Risks:<\/strong> Devices might temporarily miss corporate-only security policies upon setup.<\/li>\n<\/ul>\n\n\n\n<p><strong>When It Is Highly Recommended<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Strict Blocking:<\/strong> You block personal devices but need specific hardware to enroll.<\/li>\n\n\n\n<li><strong>Bulk Hardware:<\/strong> You buy standard Windows\/iOS hardware outside of Autopilot vendor channels.<\/li>\n\n\n\n<li><strong>Immediate Governance:<\/strong> Devices must receive strict corporate security configurations on minute one.<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Checkout my other blogs about Windows Autopilot Windows Autopilot device preparation (sometimes called V2 or &#8220;next-gen&#8221; Autopilot) in Microsoft Intune streamlines deployment by allowing IT to pre-configure apps, settings, and security policies , resulting in faster user-driven Microsoft Entra joins without needing hardware hash uploads. Please see: Windows Autopilot: Moving to v2 (Device Preparation) The&#8230;<\/p>\n","protected":false},"author":2,"featured_media":519281,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_kad_blocks_custom_css":"","_kad_blocks_head_custom_js":"","_kad_blocks_body_custom_js":"","_kad_blocks_footer_custom_js":"","ngg_post_thumbnail":0,"episode_type":"","audio_file":"","podmotor_file_id":"","podmotor_episode_id":"","cover_image":"","cover_image_id":"","duration":"","filesize":"","filesize_raw":"","date_recorded":"","explicit":"","block":"","itunes_episode_number":"","itunes_title":"","itunes_season_number":"","itunes_episode_type":"","_kad_post_transparent":"","_kad_post_title":"","_kad_post_layout":"","_kad_post_sidebar_id":"","_kad_post_content_style":"","_kad_post_vertical_padding":"","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[681,441],"tags":[742,782],"class_list":["post-520693","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-moderneuc2","category-tech-talk","tag-moderneuc1","tag-windows-autopilot"],"taxonomy_info":{"category":[{"value":681,"label":"ModernEUC"},{"value":441,"label":"Tech Talk"}],"post_tag":[{"value":742,"label":"ModernEUC"},{"value":782,"label":"Windows Autopilot"}]},"featured_image_src_large":["https:\/\/jorgep.com\/blog\/wp-content\/uploads\/Featured-WindowsAutopilot.jpg",1024,512,false],"author_info":{"display_name":"Jorge Pereira","author_link":"https:\/\/jorgep.com\/blog\/author\/jorge\/"},"comment_info":0,"category_info":[{"term_id":681,"name":"ModernEUC","slug":"moderneuc2","term_group":0,"term_taxonomy_id":691,"taxonomy":"category","description":"","parent":0,"count":269,"filter":"raw","cat_ID":681,"category_count":269,"category_description":"","cat_name":"ModernEUC","category_nicename":"moderneuc2","category_parent":0},{"term_id":441,"name":"Tech Talk","slug":"tech-talk","term_group":0,"term_taxonomy_id":451,"taxonomy":"category","description":"","parent":0,"count":707,"filter":"raw","cat_ID":441,"category_count":707,"category_description":"","cat_name":"Tech Talk","category_nicename":"tech-talk","category_parent":0}],"tag_info":[{"term_id":742,"name":"ModernEUC","slug":"moderneuc1","term_group":0,"term_taxonomy_id":752,"taxonomy":"post_tag","description":"","parent":0,"count":293,"filter":"raw"},{"term_id":782,"name":"Windows Autopilot","slug":"windows-autopilot","term_group":0,"term_taxonomy_id":792,"taxonomy":"post_tag","description":"","parent":0,"count":25,"filter":"raw"}],"_links":{"self":[{"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/posts\/520693","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/comments?post=520693"}],"version-history":[{"count":2,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/posts\/520693\/revisions"}],"predecessor-version":[{"id":520696,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/posts\/520693\/revisions\/520696"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/media\/519281"}],"wp:attachment":[{"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/media?parent=520693"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/categories?post=520693"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jorgep.com\/blog\/wp-json\/wp\/v2\/tags?post=520693"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}