Classic Windows Autopilot is a cloud control-plane workflow, not an imaging system. Hardware registration creates an Autopilot identity, Microsoft Entra ID (formerly Azure AD) can pre-create a device object containing that identity, dynamic-group evaluation targets the device, and Intune assigns a deployment profile before Windows OOBE completes Microsoft Entra join and Intune enrollment. Registration, assignment, enrollment, policy application, and compliance are separate states.
This article follows that administrator-side path and highlights where classic Autopilot differs from the newer Windows Autopilot device preparation architecture.
The control-plane path from hardware to a managed PC
- Hardware identity registration: An OEM, reseller, administrator, or supported deployment workflow uploads the device identity (commonly called the hardware hash) to the organization’s Autopilot tenant.
- Autopilot record: The device appears in Intune > Devices > Windows > Windows enrollment > Windows Autopilot devices (labels can change).
- Entra object preparation: Microsoft’s Device Registration Service can pre-create a related Entra device object and stamp a physical-device identifier known as the ZTDID.
- Targeting: An Entra dynamic device group evaluates that identifier, and Intune processes the group’s Autopilot profile assignment.
- Enrollment: Automatic MDM enrollment, configured for the tenant and the selected join path, allows the OOBE device to enroll in Intune.
- Configuration: Intune delivers applications, configuration profiles, security settings, compliance policy, and scripts. A completed profile assignment does not prove that these workloads have finished.
The sequence is asynchronous. A successful earlier step does not mean that the next step is complete.
What Autopilot solves—and what it does not
Autopilot reduces traditional staging and reimaging by using the OEM Windows installation and applying organization settings during OOBE. It supports new and reset devices, while existing-device scenarios can use Configuration Manager task sequences, PXE, Software Center, or bootable media. It is therefore better described as cloud provisioning and enrollment than as a universal imaging replacement.
#1 Best Overall
- 1.1 GHz (boost up to 2.4GHz) Intel Celeron N5030 Quad-Core
- Registration associates hardware with a tenant.
- Provisioning configures a new or reset Windows installation.
- Joining establishes Microsoft Entra join or hybrid join.
- Enrollment places the device under Intune MDM.
- Configuration applies apps, policies, baselines, scripts, and compliance settings.
Hardware identity, ownership, and tenant conflicts
The hardware identity binds a physical PC to an organization’s Autopilot tenant. Registration may be performed before shipment by a manufacturer or reseller, or by an administrator through a supported collection and upload process. A factory reset does not by itself release that association.
If a device is still registered to another organization, registration can fail with error 808, ZtdDeviceAssignedToOtherTenant. The documented remedy is for the former tenant to remove the device from its Windows Autopilot device list and allow deregistration to complete before the new tenant retries registration: source explanation of the error and remediation. Removing an Intune-managed record, deleting an Entra object, and releasing the Autopilot registration are not necessarily the same operation.
Used and resold hardware checklist
- Obtain confirmation that the previous organization released the device from Windows Autopilot.
- Wait for deregistration to propagate, then verify that the new tenant can register it.
- Do not accept “factory reset” as proof of tenant release.
- Require the reseller to document replacement and release procedures for failed or returned devices.
The Autopilot record and the Entra device object are different
Administrators can see an Autopilot record in Intune and a related Microsoft Entra device object before a user starts OOBE. The original technical description attributes this pre-creation to the Device Registration Service and identifies the ZTDID in the object’s physical-device identifiers (technical account).
Rank #2
- 256 GB SSD of storage.
- Multitasking is easy with 16GB of RAM
- Equipped with a blazing fast Core i5 2.00 GHz processor.
The object may look disabled, incomplete, or otherwise unlike a normally registered workstation. That is expected for a pre-created identity. Its presence does not prove that a user has authenticated, Windows has joined Entra ID, Intune enrollment has succeeded, applications are installed, or compliance is achieved.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsZTDID and dynamic-group targeting
The historical article shows this dynamic-membership expression:
(device.devicePhysicalIDs -any _ -contains "[ZTDId]")
It selects devices whose physical-device identifiers include the Autopilot ZTDID marker. Treat this as an architectural example from the source article, not an eternal syntax guarantee; validate the property and query against current Microsoft Entra dynamic-group documentation before deployment.
Rank #3
- 14" diagonal, 1366x768 resolution, HD BrightView LED, Glossy NON-TOUCH Display
Why targeting appears slow
- Entra dynamic membership evaluation is asynchronous.
- Intune must process the resulting group assignment separately.
- Device-side discovery and enrollment occur later during OOBE.
- Refreshing the portal may be necessary to see a newly processed state.
Use a narrowly scoped pilot group first. A broad dynamic group can unintentionally deliver large applications, scripts, or security policies to every registered device.
Creating and assigning a deployment profile
The portal workflow is commonly found under Intune > Devices > Windows > Windows enrollment > Windows Autopilot deployment profiles, although Microsoft changes labels and navigation. The important design decisions are:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Deployment mode: user-driven, self-deploying, or technician pre-provisioning.
- Join type: Microsoft Entra join or hybrid join.
- OOBE behavior: language and keyboard handling, privacy and licensing-page visibility, account type, and page suppression.
- Identity: device naming template and the user experience required for authentication.
- Enrollment Status Page: whether it is enabled, which workloads block completion, and how restarts are handled.
- Administration: scope tags, assignment filters, and administrative boundaries.
Hiding an OOBE page does not remove its underlying requirement for network access, identity, licensing, or enrollment. Hybrid join also requires on-premises Active Directory dependencies, synchronization, domain connectivity, DNS, and often line-of-sight or VPN access.
Rank #4
- EFFORTLESS EVERYDAY PERFORMANCE: Powered by Intel Celeron N4020 processor and Windows 11 Home system, delivering reliable, low-power efficiency for daily tasks like document editing, email, online classes, and web browsing
- 15.6-INCH FULL HD DISPLAY: Enjoy immersive visuals on the 15.6" FHD (1920x1080) anti-glare screen with micro-edge bezels. Delivers clear details and comfortable viewing for long study sessions, working on spreadsheets, and video playback
- RESPONSIVE MULTITASKING & STORAGE: Built with 4GB LPDDR4 RAM and 128GB eMMC storage for smooth daily essential use. Expand your storage by up to 1TB via the integrated TF card slot to easily store movies, photos, and working files
- ADVANCED CONNECTIVITY: Outfitted with 2x Full-Featured Type-C ports for data transfer, fast charging, and dual-monitor output, alongside 2x USB 3.2 Gen1 ports and a 3.5mm audio jack for complete peripheral compatibility
- LIGHTWEIGHT & SILENT OPERATION: Slim and portable for effortless travel or commuting. Features a 1MP HD webcam for remote meetings, 38Wh battery with 45W Type-C fast charging, and a fanless silent design for peaceful work environments.
Assignment states
| State | Meaning | What it does not mean |
|---|---|---|
| Not assigned | No effective Autopilot profile has reached the device record. | It does not mean registration necessarily failed. |
| Assigning | Intune is processing direct or group-based targeting. | It is not a deployment-completion indicator. |
| Assigned | A profile is associated with the device. | OOBE, join, enrollment, applications, and compliance may still be pending. |
What the Microsoft Graph call represents
The portal is a client of service APIs. The original article illustrates profile creation with this historical request:
POST https://graph.microsoft.com/beta/deviceManagement/windowsAutopilotDeploymentProfiles Content-Type: application/json
{
"@odata.type": "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile",
"displayName": "WhiteGlove",
"description": "Test",
"deviceNameTemplate": "JOY-%RAND:5%"
}
The example reports HTTP 201 Created and a returned profile ID (historical Graph example). It uses the beta endpoint and an older resource type. Before production automation, verify the currently supported API version, resource type, required fields, delegated or application permissions, administrative consent, and profile-type support in Microsoft Graph documentation.
Creation is separate from assignment. A 201 response confirms that a server-side object was created; it does not confirm group membership, device receipt, OOBE behavior, or enrollment. Production automation should log IDs, implement retry and throttling handling, and perform post-creation validation.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
- 【Efficient Performance】 Powered by Intel Core i3 processor (2 cores, 4 threads, up to 3.4GHz) with 12GB RAM and 256GB SSD. Handles multitasking, office software, online classes, and HD video streaming smoothly. Integrated Intel UHD Graphics 620
- Backlit Keyboard & Complete Package】Comes with a cool backlit keyboard. Comes with awebcam, dual stereo speakers (8Ω/1.0W each), DC charger, and user manual – ready for late-night studying, online classes, video conferencing, and daily productivity
- 【Vibrant Display】 15.6-inch Full HD (1920x1080) anti-glare screen with 16:9 aspect ratio delivers crisp images and vivid colors – perfect for studying, watching lectures, or entertainment. Thin-bezel design maximizes viewing area
- 【Fast Connectivity & Expansion】 Equipped with WiFi 6 (802.11ax) and Bluetooth 5.2 for stable, high-speed wireless. Features 3 x USB 3.0, HDMI 2.1, Type-C (supports PD3.0 fast charging), and a TF card slot expandable up to 2TB – easily connect external monitors, mice, drives, or expand storage for all your files
- 【Long Battery Life & Portable】 Built-in 11.55V 5000mAh/57.75Wh high-capacity battery delivers approximately 7 hours of mixed-use battery life – enough for a full day of classes and assignments. Lightweight at just 1.63kg (3.6 lbs) and 19.5mm thin, plus a compact packing size – easily slips into a backpack for campus, library, or coffee shop
Automatic MDM enrollment and the device-side sequence
Autopilot identifies the device and supplies the intended experience; Microsoft Entra establishes identity and join state; automatic MDM enrollment places the device under Intune management. Licensing, enrollment restrictions, join configuration, identity policies, and tenant settings determine whether enrollment can proceed.
- Windows starts OOBE and obtains network connectivity.
- Cloud services recognize the hardware as belonging to the Autopilot tenant.
- The appropriate OOBE experience is downloaded.
- The user authenticates, unless self-deploying or technician pre-provisioning is selected.
- Microsoft Entra join or hybrid join is performed.
- Automatic MDM enrollment enrolls the device in Intune.
- The Enrollment Status Page, or the applicable device-preparation experience, tracks selected workloads.
- Policies, applications, security settings, and compliance configuration are delivered.
Microsoft’s historical Autopilot flowchart shows separate TPM-attestation, Entra-join, hybrid-join, MDM, ESP, and pre-provisioning branches. Its Windows 10-era labels are architecture evidence, not a current portal map.
Troubleshoot by the observable state
| Observed state | First checks | Likely action |
|---|---|---|
| No Autopilot record | Tenant, hardware identity, reseller upload, and file validity. | Correct registration or obtain the OEM/reseller upload. |
| Entra object exists, but deployment has not started | Profile assignment, group membership, and OOBE state. | Recognize that pre-created identity can precede user setup; correct targeting if needed. |
| Not assigned | Dynamic query, membership completion, filters, scope tags, and conflicting assignments. | Fix targeting and allow processing. |
| Assigning | Refresh the portal and inspect assignment conflicts. | Allow asynchronous processing; investigate only after a reasonable propagation interval. |
| Assigned, but OOBE is unchanged | Network filtering, tenant recognition, reset state, and device logs. | Restore connectivity, reset or retry OOBE, and inspect device-side events. |
Error 808 / ZtdDeviceAssignedToOtherTenant |
Previous owner or reseller records. | Have the former tenant release the Autopilot registration, then retry. |
| ESP stalls | Win32 detection rules, required-app failures, restarts, Conditional Access, MFA, TPM attestation, hybrid-join timing, and network access. | Repair the failing workload or reduce blocking scope deliberately. |
Existing-device and Configuration Manager workflows
Organizations retaining Configuration Manager can start an Autopilot experience through a task sequence, PXE, Software Center, or bootable media. Microsoft documents a local Autopilot JSON package workflow at Create a JSON package and task-sequence execution at Run an Autopilot task sequence. The overview is at Deploy an Autopilot task sequence.
If the device is already registered and has an Intune-assigned profile, the Intune profile takes precedence over the local JSON profile (Microsoft Learn). A JSON file appearing to be ignored can therefore indicate that Intune is supplying the effective profile, not that the task sequence failed.
Classic Autopilot versus Windows Autopilot device preparation
| Criterion | Classic Windows Autopilot | Device preparation |
|---|---|---|
| Profile discovery | Relies on pre-registered device identity and profile targeting. | Obtains policy information after user authentication through a different enrollment model. |
| Registration model | Hardware registration is central. | Uses a different architecture; it is not simply a renamed v1 profile. |
| Operational model | Mature user-driven, self-deploying, pre-provisioning, and established existing-device patterns. | Newer workflow with its own supported scenarios, limits, and monitoring. |
| Migration | Existing assignments and profiles may need redesign. | Do not assume feature parity or a one-click conversion. |
A technical comparison from Recast Software and Microsoft’s 2025 and 2026 Autopilot AMAs (2025; 2026) document continuing questions about migration, app and script limits, naming, monitoring, and ordering. Choose the architecture that matches your supported requirements rather than treating device preparation as an automatic replacement.
Operational design rules
- Separate registration, group membership, profile assignment, join, enrollment, workload completion, and compliance in monitoring and runbooks.
- Use direct assignments for a small pilot when immediate attribution matters; use dynamic groups for scale after membership and blast radius are understood.
- Document tenant-release ownership for every reseller and second-hand device.
- Prefer supported portal controls for one-off changes; use Graph for repeatable bulk operations with least-privilege permissions, logging, retries, and validation.
- Design naming templates for collision handling; a template does not guarantee globally unique names, as customer reports in Microsoft’s 2025 AMA illustrate.
The practical boundary is simple: Autopilot registration creates cloud-side identity, profile assignment expresses deployment intent, and Entra plus Intune perform the actual join and management work.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
