Windows Autopilot device preparation drops the hardware hash import

In many of my projects, traditional Windows Autopilot turned out to be a bit more complex than people had hoped, mostly because of the hardware hash import. Smaller IT teams in particular keep losing track of which device has already been imported, which CSV is the current one and why a device simply doesn't show up. So when Microsoft quietly announced Windows Autopilot device preparation in early June, I paid attention right away. Preparing a Windows 11 device no longer depends on building CSVs or chasing distributors. You assign a policy to a device security group, and the device onboards itself during OOBE without any hardware hash. It's early days, and it only works for user-driven, Entra-joined Windows 11 devices, but it is already making real rollouts simpler.

Device preparation adds a second onboarding path to Windows Autopilot

Classic Autopilot isn't going away (Microsoft itself now sometimes calls it "classic Autopilot"), but device preparation gives you a modern alternative in the Intune console. The main difference is that there's no hardware hash import at all. You create a device preparation policy and assign it to a device security group. Any device that joins this group through the Intune Provisioning Client then gets the intended OOBE configuration, app installs and scripts, and you can follow the setup progress in real time. It works best with brand new or freshly reset Windows 11 devices on recent builds, because at launch device preparation supports only Windows 11 and user-driven mode with Entra join.

In practice, this makes both fleet and ad-hoc deployments a lot easier. For distributed teams, pilot users or break/fix replacements, I've found this workflow far less fragile than the legacy Autopilot onboarding. Microsoft documents the process in the feature overview and in this guide to the user-driven workflow.

The new OOBE flow runs from group assignment to a ready device

You build the device preparation policy in Intune and target it at a device group. The Intune Provisioning Client does the actual orchestration. It brings the device into Entra ID and Intune and then applies the apps and scripts you defined, with a setup status that is close to live. Keep in mind that this only happens on Windows 11 devices with the latest builds and the Provisioning Client present. Windows 10 and older hardware aren't supported.

The diagram below shows the new sequence:

flowchart TD
  start["Device boots into Windows 11 OOBE"] --> provisioningClient["Provisioning Client starts"]
  provisioningClient --> groupAssignment["Device joins device group"]
  groupAssignment --> policyAssignment["Device preparation policy applies"]
  policyAssignment --> entraJoin["Entra join & registration"]
  entraJoin --> appsScripts["Apps/scripts installed"]
  appsScripts --> ready["Device ready for user"]

Figure: Windows Autopilot device preparation policy flow during OOBE

You can see that everything revolves around group targeting and the Provisioning Client. Classic Autopilot depends on hardware imports, while device preparation depends only on group membership.

Device preparation fits some scenarios better than others

Compared with classic Autopilot, device preparation differs in these points:

• No hardware hash import or registration required
• Windows 11 only, with no hybrid join or Windows 10 support
• User-driven mode only (no pre-provisioning/White Glove yet)
• Assignment through device groups instead of import lists
• Near real-time reporting in Intune

Microsoft Learn has a comparison table that lays out the pros and cons. Organizations that need to get new or replacement devices out the door quickly will be glad to have device preparation. If you rely on hybrid join or pre-provisioning, or you still run hardware that isn't on Windows 11, you'll keep using classic Autopilot for now.

Practical tip: Device preparation has helped me a lot in projects where the Autopilot device inventory is never up to date or where nobody can say in advance which devices will need onboarding. With pilot groups and ad-hoc hardware swaps, I see far fewer mistakes and smoother handoffs to users than with the old workflow.

The current version still has clear limitations

It doesn't solve everything, though. As of mid-June 2024, hybrid join, White Glove/pre-provisioning, self-deploying mode and Autopilot reset aren't supported. Devices have to be enrolled with recent Windows 11 builds, and they always end up Entra-joined. Reporting is better and faster, but you give up some of the flexibility of classic profiles, such as dynamic assignment or specific device reset flows. Some organizations will also have to rework their asset management processes.

If you use Intune at scale, keep in mind that targeting based on group membership has to be managed tightly and documented well. When group assignments aren't clear and tested, it's easy to prepare the wrong device by accident, or too many of them.

I see device preparation as a pragmatic upgrade rather than a full replacement (yet)

Overall, Windows Autopilot device preparation is a sensible addition to device onboarding. For modern, flexible organizations and quick pilots, it's much easier than classic hardware hash imports. If the legacy registration process has ever made you swear, try the new workflow, starting with a small pilot group and up-to-date Windows 11 hardware. In large, complex or hybrid environments, though, classic Autopilot still has its place.

For more hands-on guidance on device onboarding, have a look at my earlier post on Windows LAPS with Intune and Entra ID.