Mastering Autopilot Device Preparation (Autopilot v2): Enterprise Setup, ESP Fixes & Architecture

For years, Windows Autopilot v1 required enterprise IT teams to harvest 4K Hardware Hashes from physical endpoints prior to staging. This dependency introduced supply chain bottlenecks, vendor delays, and dynamic group sync latency. With the release of Windows Autopilot Device Preparation (Autopilot v2), Microsoft fundamentally redesigned out-of-box provisioning by introducing user-group targeting and automatic Entra device object group membership.

1. Architectural Comparison: v1 vs v2 Flow

Under Autopilot v1, devices had to be registered in the corporate tenant's hardware hash database before enrollment could begin. Autopilot v2 reverses this workflow: enrollment begins immediately when a targeted user authenticates at OOBE, and Intune automatically manages device group membership in real time.

2. Technical Feature Matrix

3. Service Principal Ownership & PowerShell Automation

For Autopilot Device Preparation to successfully inject newly enrolled devices into your target Device Security Group, the Intune Autopilot Confidential Client service principal (App ID: f1346770-5b25-470b-88bd-d5744ab7952c) MUST be assigned as an **Owner** of the target Security Group.

# Connect to Microsoft Graph with Directory Administration Scopes
Connect-MgGraph -Scopes "Group.ReadWrite.All", "Directory.ReadWrite.All"

$targetGroupName = "Sec-Intune-AutopilotV2-CorporateDevices"
$group = Get-MgGroup -Filter "displayName eq '$targetGroupName'"

if (-not $group) {
    $group = New-MgGroup -DisplayName $targetGroupName -MailEnabled:$false -MailNickname "autopilotv2devs" -SecurityEnabled:$true
    Write-Host "Created assigned Security Group: $($group.Id)" -ForegroundColor Cyan
}

# Retrieve First-Party Autopilot Service Principal
$autopilotAppId = "f1346770-5b25-470b-88bd-d5744ab7952c"
$sp = Get-MgServicePrincipal -Filter "appId eq '$autopilotAppId'"

# Assign Autopilot SP as Owner of the Device Group
New-MgGroupOwnerByRef -GroupId $group.Id -OdataId "https://graph.microsoft.com/v1.0/directoryObjects/$($sp.Id)"

Write-Host "Autopilot Service Principal granted Owner rights over ($targetGroupName)" -ForegroundColor Green

4. Step-by-Step Policy Configuration Guide

1. Create Target Assigned Security Groups: Create one empty assigned Security Group for Devices and one User Group containing targeted end users.
2. Grant Service Principal Owner Rights: Execute the PowerShell script above to assign the Intune Autopilot service principal as an owner.
3. Configure Device Preparation Policy: In Intune Admin Center (Devices → Enrollment → Device Preparation Policies), click Create Policy.
4. Select Deployment Settings: Assign the User Group, link the Device Group, and select up to 10 blocking Win32/LOB apps and 10 PowerShell scripts.

5. Resolving ESP Reboot Loops & Log Diagnostics

When an Autopilot v2 deployment fails on a physical device, run the following diagnostic script to parse the local provisioning registry and Intune Management Extension logs:

# Check Autopilot Local Registry State
Get-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Provisioning\AutopilotPolicy" -ErrorAction SilentlyContinue

# Extract Last 15 Error Events from Intune Management Extension Log
$logFile = "C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log"
Select-String -Path $logFile -Pattern "\[Win32App\]" -Context 0,2 | Select-Object -Last 10

To monitor enterprise Autopilot enrollment failures across all devices in Azure Monitor, execute this KQL query:

// KQL Query: Autopilot Device Preparation Enrollment Failures
IntuneOperationalLogs
| where OperationName == "EnrollmentStatusPageFailure"
| summarize FailureCount = count() by DeviceName, UserPrincipalName, ErrorCode, ResultDescription
| order by FailureCount desc

6. Frequently Asked Questions (FAQ) - MSLearn Specifications

Q: Can Autopilot v1 and Autopilot v2 coexist in the same tenant?

Yes. If a device has a registered 4K Hardware Hash, Autopilot v1 takes precedence. If no hardware hash is present and the signing-in user is assigned an Autopilot v2 Device Preparation policy, v2 is executed.

Q: Is Hybrid Entra Join supported in Autopilot v2?

No. Microsoft Autopilot Device Preparation (v2) strictly supports **Entra Join** (Cloud Native). Hybrid Entra Join is intentionally excluded by design.

7. Conclusion

Autopilot Device Preparation streamlines enterprise deployment by eliminating supply-chain hardware hash collection while accelerating Out-of-Box provisioning speeds. Transitioning to v2 delivers a clean, resilient Cloud Native foundation for modern Windows 11 management.