Set up devices with Windows Autopilot and Intune for Education

  • Article

Applies to:

  • Windows 10
  • Windows 11
  • Windows 11 SE

Windows Autopilot is a cloud-based provisioning technology that's used in schools to set up and pre-configure new devices, getting them ready for productive use during the school year. Windows Autopilot was designed with school IT departments in mind and provides:

  • Easy device setup: Students power on their devices, connect them to the internet, and sign in. Windows Autopilot automatically configures each device from the cloud and gets them ready for the classroom.

  • Time and cost savings in large-scale deployments: Students and teachers can provision devices themselves. IT departments no longer need to set up provisioning in large warehouses and hire a fleet of technicians to set up student PCs.

  • Always up-to-date: Custom images and provisioning packages on USBs can quickly become outdated. With Windows Autopilot, student PCs always get configured with the latest Intune policies and apps.

  • Easy reset: Initiate a remote Windows Autopilot Reset from Intune for Education to quickly reset student PCs that are having issues. During a reset, all apps, settings, and user data are removed, while the devices remain enrolled in Microsoft Entra ID and Intune. After the wipe, student PCs automatically receive the latest Intune policies, which prepares them for the classroom again.

    A graphic titled "3 Steps to classroom-ready with Windows Autopilot for Edu." Shows the high-level steps to set up devices, from hardware vendor to first day of class.

Autopilot deployment in user-driven mode

Intune for Education supports Windows Autopilot deployment profiles in user-driven mode. User-driven mode simplifies the out-of-the-box (OOBE) experience so that students and teachers can easily configure their devices. During setup, they're walked through a series of screens that instruct them to:

  1. Plug in device and turn it on.
  2. Choose a language.
  3. Choose a keyboard.
  4. Optionally, choose a second keyboard.
  5. Connect to a Wi-Fi network with internet access, or connect to a wired network.
  6. Type in school’s username and password.

When they get to the enrollment status page, the device will lock until setup is complete.

Prerequisites

Complete these requirements before you begin Windows Autopilot setup in Intune for Education.

  1. Meet Windows Autopilot requirements: Make sure your school and devices meet the software, networking, licensing, and configuration requirements for Windows Autopilot.

  2. Determine user permissions: During registration, a Microsoft partner will assign group tags to your devices. If you require different user permissions on different devices, instruct your partner to split the devices in to two group tags, according to permissions. Provide names for each group. For example, if teachers get admin permissions on devices and students don't, you could name one group Contoso Teachers, and name another Contoso Students.

  3. Order and register your devices: After you or the Microsoft partner orders the devices from the OEM provider, register the devices for the Autopilot deployment service. We recommend that you connect with a partner through Microsoft Partner Center and work with them to register the devices. The partner will obtain a CSV with the devices’ information from the OEM and then upload it to Partner Center.

    Note

    You can manually register devices with Windows Autopilot, but we recommend working with someone to auto-register devices. The manual process is primarily for testing and evaluation scenarios and requires you to harvest and upload the hardware hashes from devices. The Microsoft Endpoint Configuration Manager and Windows PowerShell methods can't be used to capture hardware hashes from devices running Windows 11 SE. For more information, see Manually register devices with Windows Autopilot.

  4. Set up your tenant for Intune for Education and configure School Data Sync (SDS). After it syncs your school’s information, SDS automatically creates a group for each school in the district, and creates student and teacher groups.

  5. Configure school branding: Go to the Microsoft Azure portal to add your organization’s branding to your school devices. For instructions, see Customize your Microsoft Entra sign-in page.

Things to consider

Factors such as network and number of devices can affect or delay your setup experience.

  • Multiple student devices will be downloading data at the same time, which could overload your network.
  • All devices need to be plugged in or fully charged, which could be a challenge at scale.
  • Configuration can take up to one hour per device. It could take even longer if you’re downloading large apps, such as Office, or if multiple students are using the same network.

Create dynamic group for Autopilot devices

Create a dynamic group to quickly group Autopilot-registered devices. Setting a group tag rule will automatically create and populate a group with the devices you tagged during Autopilot registration. Dynamic groups eliminate the need for you to select and group devices one-by-one.

Group tags are assigned to devices during Windows Autopilot registration. Make sure you communicate with your Microsoft partner about your need for group tags before registration begins.

Screenshot of Groups page, Create group, highlighting dynamic group settings.

  1. Go to Groups > Create group.
  2. Name your group.
  3. Under Group type, select Dynamic.
  4. Under Rules: a. Select Devices. b. Select On this platform and then select Windows. c. Select Where and then choose Device group tag starts with from the menu. d. Type in the name of the group tag given during registration. For example, Contoso Teachers.
  5. Select Create group. All Autopilot-registered devices with the specified group tag will be added to your new group.

Once the group is created you can configure an Autopilot deployment profile for it.

Configure Autopilot deployment profiles

If this is your first time setting up Windows Autopilot in your tenant, we recommend that you start with the All Devices group, and configure a default Autopilot deployment profile for it with standard user permissions. Then you can create deployment profiles with administrator permissions for other groups.

To configure a default account with standard user permissions:

  1. Sign in to Intune for Education.

  2. Go to Groups.

  3. Select All Devices from the list of groups.

  4. Select Windows device settings > Enrollment and go to the Windows Autopilot section.

  5. Next to Configure Autopilot deployment profile for devices, select User-driven. After you select this option, the user account type appears.

    Screenshot of All Devices group, Windows Autopilot settings, with user-driven mode and standard user account selected.

  6. By default, a Standard user account type is selected. If you want all users in your tenant to be admins on their devices, select Administrator instead.

Tip

If only some of your users need to have admin permissions, create a group and deployment profile just for them. For example, if you want your staff to have admin privileges, create a group that's made up of your staff’s devices. Then complete steps 2 through 6 in this section to create a deployment profile with an administrator user account type.

Configure settings and apps

If each device in your school is used by a single user, we recommend that you:

  • Configure tenant-wide settings under the All Devices group.
  • Configure group-specific settings and apps under user groups.

You can configure settings and apps under the default groups created by SDS. You can also create custom groups specific to your school system, such as 6th grade students, and configure settings and apps there.

If the devices in your school are shared by all students, they'll most likely have similar settings and apps. Configure all common settings and apps under the All Devices group. Configure other apps and settings in the device groups where they apply.

Distribute devices

After you’re done with the configuration, and devices are delivered to each school, distribute them to students and teachers. They can set up the devices at home or at school, as long as there is a reliable network. For a brief overview of what the OOBE is like, see User-driven mode.

Monitor devices

Go to Reports > Autopilot deployment to monitor the enrollment status of your school's devices.

Use the report to quickly identify failed enrollments. To see more details or troubleshoot a failed enrollment, select a device name and then select Windows Autopilot details.

Troubleshoot devices

If you experience a problem during Windows Autopilot setup, see Troubleshooting Windows Autopilot.

Windows Autopilot Reset

When a device experiences issues during the school year, you can use Autopilot Reset to reset it to a healthy state. A reset can also be done on a group of devices. For more information, see Autopilot Reset.

Next steps

Find out about the newest Autopilot features and other changes in Intune for Education. See What's new for a monthly summary of all new features in Intune for Education.

Make changes to your groups and use remote actions in Intune for Education.