Autopilot: dynamic groups, branding and deployment profiles

The profile decides whether a device joins Entra or the domain — not the import script. Groups by ZTDId, a 10 KB logo limit, names truncated at 15.

Autopilot is often described as a way to skip the imaging step. That undersells it. What it really does is let a device that has never been touched decide, on first boot, what organisation it belongs to and what it is allowed to become.

This chapter covers the four things that decision depends on: the group the device lands in, what the user sees while it happens, the profile that governs it, and the status page that gates it.

First decide the join model — and know what decides it

This is the single most misunderstood point in Autopilot.

Model	Object in the on-prem DC?	When to use it
Entra ID join	No	The modern default. No dependency on a domain controller during OOBE
Entra hybrid join	Yes	Only with real on-premises dependencies — legacy apps, GPOs you cannot migrate
Classic domain join	Yes	The old model. No Intune

A device that is Entra-joined can still get Kerberos single sign-on against on-premises resources through Cloud Kerberos Trust. Needing file shares is not, by itself, a reason to choose hybrid join.

This chapter uses Entra ID join.

The dynamic group

Autopilot devices need to land in a group automatically, because at the moment the profile has to be assigned the device has no user, no name and no enrolment.

Intune and Entra both show a tempting rule:

device.deviceOSType -eq "Windows"

Do not use it. That matches every Windows device in the tenant, including machines enrolled by hand and the laptop you are reading this on. The profile would be assigned to all of them.

Use the rule that matches Autopilot devices specifically:

(device.devicePhysicalIds -any (_ -contains "[ZTDId]"))

ZTDId is the Zero Touch Deployment identifier, written onto the device object when the hash is imported. Only devices that came through Autopilot have it.

Entra → Groups → New group → type Security, name it Autopilot-Windows-Devices.
Membership type → Dynamic Device.
In the rule editor switch to the text box and paste the ZTDId rule above.
Validate rules against a device you already imported, then save.

Company branding

During OOBE the user sees a Microsoft sign-in screen. Branding makes it recognisably yours, which matters more than it sounds: the alternative is asking someone to type company credentials into a screen with no company on it.

Entra → Company branding → Customise. Upload the logo, a background, set the colours, and write a sign-in message.

The deployment profile

Intune → Devices → Windows enrollment → Deployment Profiles → Create profile → Windows PC.

Setting	Value	Why
Deployment mode	User-driven	The user signs in and becomes the device’s primary user
Join to Entra ID as	Entra ID joined	See the table above
Microsoft Software Licence Terms	Hide	Already accepted at the organisation level
Privacy settings	Hide	Governed by policy, not by the person unboxing a laptop
User account type	Standard	Nobody needs local admin by default. LAPS covers the cases that do
Automatically configure keyboard	Yes	With a caveat — see below
Apply device name template	Yes	`WA-%RAND:6%`

Assign it to the dynamic group. Refresh the Autopilot devices page: the profile status moves to Assigned.

The device name template, and the 15-character wall

Windows computer names are limited to 15 characters. The template is applied and then truncated, silently.

Using WA-%SERIAL% on a device whose serial was W11-AUTOPILOT-001 produced:

WA-AUTOPILOT001

Exactly fifteen characters — the rest was cut. With real hardware, serials are often longer and less predictable, so %SERIAL% produces names that are truncated in ways you cannot foresee.

Use WA-%RAND:6%. Random digits with a fixed prefix give names of a known length that never collide.

Keyboard: the setting requests a language, it does not install one

Automatically configure keyboard combined with a region setting looks like it will produce an Italian device. It will not, if the image cannot do it.

An en-US ISO does not contain the Italian language pack. The Autopilot profile asks for Italian, the image has no Italian, and OOBE falls back to en-US entirely — keyboard included. The chapter on language and keyboard covers the ways out.

The Enrollment Status Page

The ESP is what the user watches while the device configures itself. It also decides whether they are allowed to reach the desktop before it finishes.

Intune → Devices → Windows enrollment → Enrollment Status Page.

Setting	Value
Show app and profile installation progress	Yes
Block device use until all apps and profiles are installed	Yes
Install Windows updates during OOBE	No

What a working OOBE looks like

Worth knowing, because the first screen tells you whether the profile arrived before you have any other signal.

“Let’s set things up for your work or school” — this is the signal. A device without an Autopilot profile asks first whether the setup is personal or for work. Going straight to the work screen means the profile was applied.
Sign-in with the user’s credentials plus MFA. Branding and the custom message appear here, on the password page.
Device preparation: securing hardware, joining the organisation’s network, registering for MDM → reboot.
Device setup, then Account setup, then the desktop.

On the resulting desktop: the required apps installed, OneDrive already signed in, and the user is a Standard account — manage-bde refuses to run, which is the correct behaviour rather than a fault.

A note if you are testing on a VM

Two things that only bite on virtual machines, both covered in adjacent chapters but worth collecting here:

No SMBIOS serial means the hash import silently registers zero devices.
Mounted ISOs prevent BitLocker from starting, with an event log that blames the TPM instead.

And one convenience: Proxmox → Options → Display → Clipboard = VNC enables copy and paste into the console. It requires the VM to be powered off, and it is worth doing before you find yourself typing a device code by hand.