I provision a small set of essential apps first and prove it on a clean test device. I expand the pilot only after deployment reports and user experience agree.
Before I start
- An Intune tenant, suitable Intune/Entra licences assigned to the pilot users, and deployment administrator permissions.
- A supported, currently serviced Windows 11 image meeting Microsoft’s device preparation requirements.
- A test device you may reset, tested application packages, and network access to the required endpoints.
Step by step
Confirm this is the right deployment path
Device preparation is distinct from classic Autopilot. This guide covers user-driven Entra join. I check the current requirements and association state: classic registration takes precedence for an unassociated device, while device association can select device preparation. I confirm the intended path before resetting a pilot device.
Microsoft: current requirements · Microsoft: device preparation policy
Scope automatic MDM enrollment
In Intune/Entra, configure Windows automatic enrollment for the pilot users. Confirm those users are allowed to join devices to Entra and stay within the device limit. I record the exact assigned user group.
Create the assigned device group
Create an assigned security device group, for example AP-DP-Pilot-Devices. Add the Intune Provisioning Client service principal as an owner using Microsoft’s documented group setup. If it is missing, follow the documented service-principal provisioning steps rather than substituting a user.
Create the pilot user group
Create a small user security group and add licensed test users. This is the policy audience; the assigned device group is where the provisioning service places devices. I keep those purposes separate.
Assign and test essential apps
Assign the essential apps and scripts to the device group and validate installation context and detection rules. I begin with two or three applications and no optional scripts. A selected app must also have a valid assignment.
Create the device preparation policy
In Intune, open Devices > Windows > Enrollment > Device preparation policies, select Create > User Driven, and name the policy. Select the assigned device group, Entra join and standard-user settings, then choose the tested essential apps/scripts. Assign it to the pilot user group, review, and save.
Handle trusted-device enrollment
If personal-device enrollment is blocked, use the current supported corporate-identifier or device-association path before deployment. Microsoft’s device association can also enable extra OOBE settings; do not assume an old hardware-hash workflow is required here.
Run OOBE and inspect the report
Reset only the designated test device after safeguarding its data. Connect it to the network and sign in as the pilot user. Inspect the device preparation deployment report, group membership, installed apps, user privilege, and subsequent compliance policy application. I save the deployment evidence before wider rollout.
How I check the result
0 of 4 checks completed
Checklist progress stays in this browser. I use it to track checks, not to certify a deployment or compliance.
If something does not work
Desktop appears without preparation
Check policy user assignment, licence, image version, automatic enrollment, and classic profile precedence.
No group membership
Check the assigned device group and the Intune Provisioning Client owner.
Application blocks deployment
Inspect the app report, device assignment, system context, dependencies, and detection rule.
My working templates
I capture device preparation assignments, application results, and rollout decisions.
Download CSV ↓Official sources I checked
I checked these sources on 13 October 2026. Product screens and legal requirements change; I verify the relevant source before a production rollout or legal decision.