Enrollment with Windows Autopilot

In the previous article, we explored various enrollment concepts. Now, we setup our new Microsoft Intune environment. This guide provides a full guide of steps necessary for a successful enrollment with Windows Autopilot.


Domain Setup

Microsoft 365 Admin Center

To use Microsoft Intune and Windows Autopilot properly, it’s recommended to use a custom domain. Let’s set this up. Open the “Domains” section in the M365 admin center and follow these steps to add the necessary DNS records for Microsoft Intune.

DNS Records

Enterprise Registration


Enterprise Enrollment



After adding DNS records, Microsoft checks them. If the necessary records are published by your DNS provider, your “Domain Section” in the admin center should look like this:

To ensure everything is set up correctly, go to the Intune admin center and start CNAME validation from here.

Enrollment Settings

Automatic Enrollment Overview

Configure Microsoft Intune admin center
  • MDM User Scope: This setting allows you to specify which users in your organization will be managed by Intune’s MDM (Mobile Device Management) capabilities. Options include “none” for no users, “Some” for specific users or groups, and “All” for every user.
  • MDM URLs: Terms of use, discovery, and compliance URLs for MDM are provided. The discovery URL is particularly important as it allows devices to locate the MDM service. The compliance URL is used to manage or display compliance policies.



User Enrollment


Device plattform restrictions

With device platform restrictions, you can define which type of device is allowed to be managed with Intune. You can find this setting in the Intune admin center. Click on “All Users” > “Properties”, and you will see this page.

Click on “Edit” and adjust the settings to your company’s needs. Consider the following situations:

BYOD (Bring your Own Device)

Company Owned Devices Only

Device limit restrictions

This section defines the limit of devices a user can enroll and can be found here. The default value is 5, which means a user can enroll up to 5 devices, including Windows, MacOS, iOS, or Android devices (if you have allowed it in device platform restrictions). Adjust this value according to your company’s needs.

I would set it to 2, because in most situations a user has a notebook / pc and a phone.

Windows Autopilot Setup

Please have a look at my previous post to see how to add devices to Windows Autopilot.

Overview of Windows Autopilot Enrollment

Deployment Profile

Every Windows device will reach out to Autopilot Service during the setup process, if it’s associated with a tenant then Windows Autopilot will provide it with your “Windows Autopilot Deployment Profile” of your choice.

In his blog, Rudy offers a comprehensive and precise description what happens during autopilot deployment.

Windows Autopilot Deployment Profiles can be created here. An “Entra ID only join (user-driven)” profile looks like this:


Out-of-box experience (OOBE)


Self-deploying is generally available now! To learn more about it please read my previous post.

Enrollment Status Page

The last part of the configuration/enrollment process involves the Enrollment Status Page (ESP). It can be accessed as follows: Navigate to “All users and all devices” > “Properties”, where you’ll encounter the default configuration, which appears as follows:

Boring right? While many people may prefer it this way, I like to know what the device is doing. So, let’s turn it on to view every parameter of the configuration:


That’s it

After setting up the Enrollment Status Page and completing all the previous steps described in this post, you’re theoretically ready to set up your first device with Microsoft Intune. But wait, there are settings needed for your devices, right? More on that in the next post.