Autopilot Device Preparation vs Windows Autopilot: Which to Use

Microsoft now ships two products with "Autopilot" in the name, and they don't work the same way. Pick the wrong one and a user sits at the out-of-box experience while a profile you never meant to apply takes over, or a hybrid-join requirement you forgot about blocks the whole rollout.

The choice is also on the exam. The MD-102 skills outline that took effect on October 27, 2026 lists "Choose between Windows Autopilot deployment profiles and device preparation policies" under deploying Windows clients. This guide gives you the decision rules, the setup steps, and the traps, all checked against Microsoft Learn.

What Windows Autopilot device preparation is

Microsoft describes device preparation as a re-architecture of Windows Autopilot. Users see a similar experience, but the plumbing differs in three ways that matter:

• No device registration. Classic Autopilot needs each device's hardware hash uploaded before deployment. Device preparation doesn't.
• Enrollment time grouping. When the user signs in, Intune adds the device to a device security group you chose in the policy. Apps, scripts, and policies assigned to that group land right away, instead of waiting for a dynamic group to recalculate.
• Ordered delivery. Device preparation installs apps and scripts one after another, so you can deploy line-of-business (LOB) and Win32 apps in the same deployment. Classic Autopilot can't mix those two reliably.

Device preparation also drops the Enrollment Status Page (ESP). Users see a "Setting up for work or school" screen with a percentage, and admins get a deployment report with app and script status in near real time.

Device preparation vs classic Autopilot: the comparison

Read the government row carefully. Some third-party comparisons get it backwards. Microsoft's table shows device preparation supporting GCC High and DoD and classic Autopilot not supporting them.

Which one should you use?

Choose device preparation when all of these are true:

• Devices run Windows 11 at the supported build (see requirements below)
• Devices join Microsoft Entra ID only, with no hybrid join
• Setup needs 25 apps or fewer and 10 scripts or fewer
• You'd rather skip hardware hash uploads from your OEM or reseller

Stay on classic Autopilot when any of these is true:

• You still have Windows 10 devices or need hybrid join to on-premises Active Directory
• Technicians pre-provision devices before shipping them, or kiosks use self-deploying mode
• You rely on Autopilot Reset, Configuration Manager co-management, or DFCI firmware management
• Users must not reach the desktop until user-based policies finish

You don't have to pick one for the whole company. Microsoft supports running both side by side, and there's no requirement to migrate existing Autopilot profiles. Each device runs exactly one of the two.

Requirements you can't skip

• Windows build: Windows 11 version 24H2 or later, or version 23H2 or 22H2 with update KB5035942 or later. Installation media dated April 2024 or later includes it. Confirm that your OEM ships devices with the update installed.
• Editions: Windows 11 Pro, Pro Education, Pro for Workstations, Enterprise, Education, or Enterprise LTSC.
• Licensing: a subscription that includes Microsoft Entra ID P1 and Intune, such as Microsoft 365 Business Premium, Microsoft 365 E3 or E5, or EMS E3 or E5. Assign the license to the user.
• Configuration: Windows automatic enrollment into Intune, and the first user who signs in needs permission to join devices to Microsoft Entra ID.
• Network: DNS for internet names, and access on ports 80, 443, and UDP 123 for time sync. Configure proxy settings on the proxy server itself. Microsoft notes that proxy settings through Intune policy aren't fully supported here.

Set up a user-driven deployment in six steps

1. Turn on Windows automatic enrollment in Intune.
2. Allow users to join devices to Microsoft Entra ID.
3. Create an assigned device security group and make the Intune Provisioning Client service principal its owner. Its AppId is f1346770-5b25-470b-88bd-d5744ab7952c. In some tenants it appears as Intune Autopilot ConfidentialClient. If it's missing, add it with New-MgServicePrincipal -AppId f1346770-5b25-470b-88bd-d5744ab7952c from the Microsoft Graph PowerShell SDK. You don't add devices yourself. Deployment adds them.
4. Create a user security group for the people who get this deployment. Microsoft recommends a new group instead of reusing an Autopilot one.
5. Assign apps and scripts to the device group, then create the device preparation policy. In the policy, pick the device group, the user group, and the essential apps and scripts that must install during setup.
6. Deploy the device. If you block personal device enrollment, add a Windows corporate identifier or associate the device with your tenant first. Associating a device also unlocks extra policy settings, including OOBE customization and device naming.

Apps and scripts that are assigned to the device group but not selected in the policy install after the user reaches the desktop, along with user-based configuration. Keep the policy list to what the user needs on day one.

Device preparation pairs well with Conditional Access that requires a compliant device. Our Conditional Access guide shows how to build that policy, and CMD vs PowerShell helps if you're converting old batch setup scripts into the PowerShell scripts the policy runs.

Five traps that break deployments

1. A registered device ignores your device preparation policy

If a device has a classic Autopilot registration and isn't associated with your tenant, the Autopilot profile wins. To run device preparation on it, associate the device or deregister it first.

2. You see the Enrollment Status Page

Device preparation never shows the ESP. If the ESP appears, the device is running classic Autopilot, usually because it's registered or has a profile assigned.

3. Old installation media

A Windows 11 23H2 image from before April 2024 lacks KB5035942, so it doesn't meet the device preparation requirement. Microsoft publishes updated installation media in the Microsoft 365 admin center.

4. Expecting hybrid join

Device preparation supports Microsoft Entra join only. If users still need line of sight to on-premises Active Directory for AD password resets or Group Policy, plan for that before moving them. Entra joined devices can still reach on-premises resources with the right network access.

5. Missing Intune RBAC permissions

Admins who build these policies need a role with Device configurations (read, create, update, delete, assign), Enrollment programs (Enrollment time device membership assignment), and read access to Managed apps, Mobile apps, and Organization. That enrollment-time permission is the one most custom roles miss.

What MD-102 expects

The October 27, 2026 MD-102 outline touches device preparation in several places:

• "Choose between Windows Autopilot deployment profiles and device preparation policies"
• "Choose between Windows Autopilot deployment modes, including user-driven, pre-provisioning, and self-deploying"
• "Target a profile by using assignment filters and enrollment time grouping"
• "Create an Enrollment Status Page (ESP)", which applies only to classic Autopilot

Expect scenario questions that hide one disqualifier, such as a Windows 10 fleet, a hybrid join requirement, or a kiosk. Spot it, and the answer is classic Autopilot. With no disqualifier and a Windows 11, cloud-only fleet, device preparation is the answer.

Frequently Asked Questions

Does Windows Autopilot device preparation replace Windows Autopilot?

No. Microsoft runs both in parallel and continues to invest in classic Autopilot. You don't need to migrate existing Autopilot profiles.

Does Windows Autopilot device preparation support Windows 10?

No. It requires Windows 11 version 24H2 or later, or version 23H2 or 22H2 with KB5035942 or later.

Does device preparation support hybrid join?

No. Device preparation supports Microsoft Entra join only. Use classic Windows Autopilot for Microsoft Entra hybrid join.

Do I need to upload hardware hashes for device preparation?

No. Device preparation doesn't require device registration. You can optionally associate devices or add corporate identifiers if you block personal enrollment.

How many apps can device preparation install during setup?

Up to 25 essential apps and up to 10 PowerShell scripts during the out-of-box experience. Other apps assigned to the device group install after the user reaches the desktop.

Sources: Compare Windows Autopilot device preparation and Windows Autopilot, Device preparation overview, Device preparation requirements, Device preparation FAQ, User-driven Entra join workflow, and the MD-102 study guide on Microsoft Learn.