186: Autopilot Device Preparation & Device Association
Implementation Effort: Medium – Requires configuring device preparation policies, enrollment time grouping, and optional device association for corporate-owned hardware.
User Impact: Medium – Streamlines out-of-box provisioning for end users and Cloud PCs while ensuring required security policies and apps are present before desktop access.
Overview
Windows Autopilot device preparation is the next-generation cloud provisioning workflow used to set up and pre-configure new Windows 11 physical devices and Windows 365 Cloud PCs, getting them ready for productive and secure use.
Key 2025–2026 capabilities include:
- Windows Autopilot Device Association (August 2026): Binds a physical Windows 11 device to your organization before enrollment. Associated devices are automatically marked as corporate-owned and can receive device-targeted policy assignments, device naming, and OOBE customizations without requiring legacy hardware hash CSV uploads.
- Automatic Mode for Windows 365 (GA May 2026): Provisions Windows 365 Enterprise, Windows 365 Flex (dedicated and shared), and Windows 365 Cloud Apps at creation time so apps, scripts, and configurations are delivered before the user ever signs in.
- Up to 25 Apps & Enterprise App Catalog (EAM) Support: Admins can configure up to 25 apps (increased from 10) to install during OOBE, including prepackaged Enterprise App Catalog apps, Win32 apps, and Microsoft Store apps.
- Managed Installer Policy & BitLocker Prioritization during OOBE (2026): Applies the Managed Installer policy (App Control for Business) during OOBE before Win32/Store/EAM apps install, and skips the default 128-bit BitLocker policy during OOBE so admin-configured BitLocker encryption policies take priority immediately.
- Immediate IME Sync: The Intune Management Extension (IME) initiates a sync immediately after OOBE completes, accelerating post-enrollment app and script delivery.
This supports Verify explicitly and Assume breach by ensuring devices are bound as corporate assets, encrypted with organization-defined BitLocker settings, protected by Managed Installer rules, and provisioned with security agents before the user reaches the desktop.