Rolling out Intune and Windows Autopilot in a small business

This is the order we would follow to bring a business of 10 to 150 people from unmanaged laptops to Intune and Windows Autopilot. It assumes Windows laptops, Microsoft 365 already in use, and no on-premises domain you need to keep. Every tenant differs, so treat it as a checklist to adapt rather than a script.

Before you start

• Licences assigned to users. Autopilot needs Entra ID P1 and an MDM service such as Intune. Business Premium covers both. Microsoft notes that the licences still have to be assigned to each user before they can enrol a device.
• The right Windows edition. Autopilot supports Windows 10 and 11 Pro, Enterprise and Education editions, among others. Windows Home isn't on the list, so budget to upgrade or replace any Home laptops.
• Automatic enrolment switched on. In Intune, the MDM user scope must be set to All or to a group (Some). If it is None, devices won't enrol automatically.
• Users allowed to join devices to Entra ID. In user-driven mode the first person to sign in needs that permission.
• Company branding. Optional, but Microsoft recommends it: the sign-in screen then shows your logo and tenant name, so staff know they are in the right place.
• A join decision. Microsoft recommends deploying new devices as cloud-native Microsoft Entra joined devices, and doesn't recommend hybrid join for new devices, including through Autopilot. For most businesses without an on-premises server, Entra join is the simpler path.
• An application list. Write down every application each team needs, who supplies it and how it is licensed. This is usually the slowest part.

The rollout sequence

1. Sort out sign-in first. Make sure everyone has working MFA and that you have emergency access accounts before you start requiring things of devices. Our Conditional Access baseline covers this.
2. Build the device baseline and assign it to a pilot group. A compliance policy (encryption, a minimum Windows version, and the threat level Defender reports), a BitLocker policy, Windows update rings with sensible deadlines, and Defender onboarding. Intune supports silent BitLocker encryption, so users aren't asked to make choices about it, and the encryption report shows recovery keys to admins.
3. Package the applications. Microsoft 365 Apps can be deployed from Intune. If you're on Business Premium, Intune needs the Microsoft 365 Apps for business suite configured with XML. Old .msi Office installs must be removed first or the Intune install fails. Line-of-business software is usually packaged as a Win32 app.
4. Register devices with Autopilot. For new purchases, ask the supplier to register the devices to your tenant; Microsoft describes OEM, reseller or distributor registration as the ideal. For laptops already in use, you can capture the hardware hash and upload it yourself.
5. Create the Autopilot profile and Enrollment Status Page. User-driven mode suits most small businesses. The Enrollment Status Page holds the user at a progress screen until the apps and policies you mark as required are installed, so keep that list short: security tools and the apps people need on day one.
6. Pilot with three to five people. Pick people who will tell you what went wrong, including one who travels. Reset or unbox a device each, watch the whole process, and fix what you find.
7. Roll out in waves. Move one team at a time, with a one-page note telling them what will happen and when. Keep a spare laptop ready for anyone whose rebuild goes badly.
8. Only then enforce compliance. Once devices report healthy, set Intune's "Mark devices with no compliance policy assigned as" to Not compliant, and turn on the Conditional Access rule that requires a compliant device, starting in report-only mode.

What staff will notice

For a new or reset laptop in user-driven mode, the steps Microsoft gives the user are short:

1. Unbox the laptop, plug it in and turn it on.
2. Choose a language, region and keyboard if asked.
3. Connect to wi-fi or a cable with internet access.
4. Sign in with their work email address and password on a screen that shows your company name and logo.

Windows then joins the organisation, enrols in Intune and shows the Enrollment Status Page while apps install. Depending on what is required, that can take a while, so tell staff to start it on a good connection and not at 8:55am before a meeting. If the device restarts during the device setup phase, the user has to sign in again. After that, the changes they notice are small: update restarts arrive on a schedule with a deadline, and a lost laptop is a phone call instead of a crisis.

Pitfalls we see

• Devices still registered elsewhere. A laptop registered to a previous provider's or a parent company's tenant has to be deregistered there first: deleted from Intune, then removed from Autopilot. Laptops that are only Entra registered (the "workplace joined" state used for personal devices) must also be removed before Autopilot registration.
• Deleting the wrong object. Registering a device creates an object in Entra ID. If someone tidies it away, the device can fail to enrol through Autopilot.
• Motherboard repairs. The hardware hash survives small changes such as a new drive, but a motherboard replacement usually needs a new hash uploaded.
• Too much in the Enrollment Status Page. Every required app is another chance for setup to stall. Required means the user can't work without it.
• Network filtering. Autopilot needs DNS and access on ports 80, 443 and 123 to a list of Microsoft services. Proxy settings belong on the proxy, not in an Intune policy.
• Compliance enforced too early. By default Intune treats a device with no compliance policy as compliant. If you flip that setting and enforce Conditional Access before devices are reporting, people get locked out on a Monday.
• Old Office installs. Leftover .msi versions of Office block the Intune deployment of Microsoft 365 Apps until they are removed.

A note on Autopilot device preparation

Microsoft now also offers Windows Autopilot device preparation, a newer profile type that supports Windows 11 only and Entra join only, and adds devices to a group at enrolment so configuration arrives sooner. If a device is registered for classic Autopilot, which deployment runs depends on whether it is associated with your tenant. For a small fleet, pick one approach and use it consistently.

How 365msp runs it

Intune and Autopilot are part of our device management service, included in the $150 per user monthly fee. In a handover, devices are enrolled in stages after the baseline is in place, and staff get a one-page note about what changes for them. Once Autopilot is set up, new laptops can ship straight to the person who will use them.