How Intune Autopilot Works

by David | Jul 17, 2026 | Intune

Years ago onboarding a new hire meant somebody on IT physically imaging a laptop, installing the fifteen apps by hand, joining it to domain, then shipping it or hand delivering it. Took most of a day per machine if nothing went wrong, which something always did. Now the box just shows up at the person's house, they open it, sign in, and by the time they've cracked open a Dr Pepper the thing is already domain joined and pulling down apps on its own. Thats Autopilot, and its genuinely one of the better tricks Microsoft has pulled off in this space.

What Autopilot actually is

Windows Autopilot is a zero touch deployment system. The device ships straight from the OEM to the end user, no IT hands ever touch it, no custom image gets built. It uses whatever Windows install the manufacturer already put on it. All the actual configuration happens automatically the moment the user turns it on and connects to a network.

From the user's side, this is genuinely almost nothing:

1. Unbox it, plug it in, turn it on
2. Pick language, locale, and keyboard if needed
3. Connect to Wi-Fi or plug in ethernet
4. Sign in with their work account

Everything after that is automated. The device joins Microsoft Entra ID, enrolls in Intune, and starts pulling down whatever apps and policies you've assigned to it.

How the device even knows what to do

Every device has a hardware hash, basically a fingerprint generated from its hardware. Autopilot registration is just getting that hash into your tenant so Intune recognizes the device the moment it shows up on the network. There are two common ways this happens:

• OEM registration, the reseller or manufacturer registers the hash for you at time of purchase. This is the actual zero touch version, you buy it, it ships, its already known before it even arrives.
• Manual registration, you run the Get-WindowsAutopilotInfo PowerShell script against the device, which uploads the hash directly, or exports it to a CSV you import into the Intune admin center yourself under Devices > Enrollment > Windows Autopilot > Devices.

Once the hash is in and a deployment profile is assigned to the group that device belongs to, Autopilot has everything it needs.

Setting up a deployment profile

The deployment profile is what actually defines the OOBE experience, this is the part people usually mean when they say "set up Autopilot."

1. Intune admin center > Devices > Windows > Enrollment > Deployment Profiles
2. Create Profile > Windows PC
3. Name it, give it a description
4. On the Out-of-box experience page, pick your Deployment mode, User-driven for devices tied to a specific person, Self-deploying for devices with no user, like a kiosk, which skips the sign in step entirely
5. Choose whether the device joins Microsoft Entra ID or Microsoft Entra hybrid join
6. Configure the OOBE screens, hide or show the EULA, hide or show privacy settings, set the user account type to Standard or Administrator
7. Assign it to the device group that contains your registered hardware hashes

That name template setting is worth calling out specifically. You can set device names automatically during enrollment using macros, %SERIAL% for the hardware serial number, or %RAND:4% for a random four digit string. Saves you from a fleet of laptops all named DESKTOP-7F3K9X2.

The part that installs the company app and sets up the account: the Enrollment Status Page

This is the piece people are usually actually picturing when they imagine Autopilot, a progress screen that shows apps and settings landing on the machine before the user is let loose on it. Thats the Enrollment Status Page, ESP.

ESP runs in two phases:

• Device ESP phase, Windows configures itself and installs anything assigned to the device itself, before any user signs in
• User ESP phase, once the person signs in with their own account, whatever's assigned to that user, their specific apps, their specific config, gets applied

To set it up:

1. Intune admin center > Devices > Windows > Enrollment > Enrollment Status Page
2. Select Default, or create a new profile
3. Turn on Show app and profile installation progress
4. Decide if you want Block device use until all apps and profiles are installed, this is the setting that actually stops the user from bailing out to the desktop before your company app finishes installing
5. Assign it, same as any other profile

So the actual flow a new hire experiences: box arrives, they power it on, connect to Wi-Fi, sign in with their work email. Device phase runs quietly for a minute. Then the user phase kicks in, the ESP shows a progress bar while your company app installs and their account gets fully configured. When it hits 100 percent, they're sitting at a working desktop with everything already there. No helpdesk ticket, no IT visit, no imaging.

Worth knowing before you flip it on

• Self-deploying mode requires specific hardware, TPM 2.0 and a few other things, since theres no user around to authenticate
• Assignment isnt instant, Intune periodically checks assigned groups and it can genuinely take a while depending on group membership and hash sync timing, dont panic if a brand new device doesnt pick up its profile in the first five minutes
• If you're going the manual registration route instead of OEM registration, that PowerShell script needs to run either during OOBE itself via Shift+F10 for a command prompt, or from an already set up device

Putting it together

Autopilot is really three pieces working together. The hardware hash tells Intune this device exists and belongs to you. The deployment profile tells it what the OOBE screens should look like and whether a user is involved at all. And the Enrollment Status Page is what actually holds the user back long enough for your company app and their account to finish setting up before they get free rein on the machine. Get those three pieces right and shipping a laptop straight to someone's house stops being a leap of faith.

What can we learn as a person

What gets me about Autopilot is that the device doesnt need anyone standing over it to become useful. It just needs to be registered ahead of time, know where its supposed to end up, and be given a little patience while the pieces land in the right order. Nobody's hovering, nobody's babysitting each step, it just quietly becomes what its supposed to be if you set the groundwork up front.

I think a lot of us wait for someone to hand deliver us fully configured too, wait for a mentor, a plan, someone to walk us through every screen personally, before we believe we can actually become anything. But most of the time the groundwork was already there. We were already registered, so to speak. We just needed to turn on and give the process room to run instead of white knuckling every single step ourselves.

So whats the deployment profile you've already got sitting there, ready to go, that you just havent powered on for yet?

Further reading

• Windows Autopilot user-driven mode
• Configure Windows Autopilot profiles
• Set up the Enrollment Status Page
• Manually register devices with Windows Autopilot
• Overview of Windows Autopilot device preparation

Does Intune Monitor Your Activity?

by David | Jul 15, 2026 | Intune

Had someone ask me, half joking half not, "can my company see what I'm doing on my phone since IT installed that app on it." And I get why they asked like that, half joking. Because the honest answer is "kind of, but way less than you think, and also maybe way more than you think, depends what else they've bought." Not a great one liner, so lets actually break it down.

What Intune actually sees

Intune by itself is a device management tool, not a surveillance tool, and Microsoft is actually pretty explicit about this in their own privacy documentation. What it collects as standard, required data:

• Device details, name, model, manufacturer, OS version
• Compliance and enrollment status
• App inventory, meaning the name and version of apps installed, not what you did inside them
• Admin audit logs, meaning what your IT admin did in the console, not what you did on your device

Theres also optional stuff an admin can turn on if they want, and it has to be turned on, its not default:

• Enhanced device inventory, non sensitive hardware details like CPU, disk, and memory info
• Device query, for corporate owned Windows devices only, lets an admin query specific file names and file paths on demand
• Location, and this one only applies to corporate owned devices, never personal ones, and even then its not constant tracking, its an on demand "locate this device" action, usually used for lost or stolen device scenarios

What Intune flat out never sees

This part is directly from Microsoft's own data collection documentation, not marketing spin. Regardless of what an admin turns on, Intune does not collect or allow an admin to see:

• Calling or web browsing history
• Personal email
• Text messages
• Contacts
• Passwords to personal accounts
• Calendar events
• Photos, including your camera roll

On a personal device enrolled with just app protection policies, its even narrower than that, Intune is really only aware of the managed apps and their data, the personal side of the phone stays out of view entirely. Thats the whole point of app protection policies over full device enrollment for BYOD, it draws a line around the work container instead of the whole device.

Where it changes: when Purview or Defender is in the picture

Heres the part people miss. Intune manages the device. It doesnt inspect the content flowing through it. Thats a completely different product, Microsoft Purview, and it only sees anything once a device is separately onboarded into it.

Onboarding happens through Microsoft Purview's device management center, deployed via a script, Group Policy, Configuration Manager, or yes, through Intune as the deployment mechanism. But being Intune managed doesnt automatically mean Purview onboarded, they're separate steps. If a device is already onboarded to Microsoft Defender for Endpoint, it shows up in Purview's managed device list automatically, you just have to turn on device monitoring to activate it for Endpoint DLP.

Once a device is onboarded and device monitoring is turned on, this is where the visibility actually jumps. Endpoint data loss prevention can see and act on things like:

• Copying sensitive content to USB drives
• Printing sensitive documents
• Uploading sensitive files to cloud apps through the browser
• Pasting sensitive content into third party AI sites like ChatGPT through Edge for Business

And critically, once a device is onboarded, information about these audited activities starts flowing into Activity explorer even before an admin configures a single DLP policy. So enrollment into that layer alone increases visibility, before any rule is even written.

Stack Insider Risk Management on top of that and it goes further still, correlating signals across a 90 to 120 day window to flag anomalous behavior, like a departing employee suddenly copying a bunch of files somewhere they normally dont touch. Microsoft does pseudonymize users by default in that system and gates it behind role based access and audit logs, so its not a free for all, but its a genuinely different level of visibility than plain Intune.

Putting it together

If someone asks "does Intune monitor my activity," the honest answer is Intune alone is closer to a management tool watching device health and app inventory, not a content watcher, and there's a documented list of things it flat out never touches regardless of settings. The real answer changes the moment you ask "what else has my org bought and turned on." Purview's Endpoint DLP and Insider Risk Management are the tools that actually look at content and behavior, and they require their own separate onboarding step, they dont just switch on because a device is Intune enrolled. If you want to know what's actually being watched at your org, the real question isnt "is this device managed," its "what security stack sits on top of Intune, and has anyone turned device monitoring on."

What can we learn as a person

I think the uncertainty is actually the honest part of this. I cant tell someone with total confidence "nobody is watching you" or "everybody is watching you," because it genuinely depends on layers I cant see from where I'm standing, what their org bought, what got turned on, what policy got written last month. And I think thats true of a lot of things in life too, not just IT. We want a clean yes or no answer about whether we're safe, whether we're being judged, whether something's being tracked or held against us, and a lot of the time the honest answer is "it depends on layers you cant fully see either." That uncertainty is uncomfortable, but pretending we have full visibility when we dont is worse, it just delays the discomfort instead of sitting with it.

So where in your life are you assuming a clean answer, safe or not safe, watched or not watched, when the honest truth is you genuinely dont have full visibility into it? What would it look like to just sit in that uncertainty instead of forcing a verdict?

Further reading

• Data collection in Intune
• Privacy and personal data in Intune
• Learn about Endpoint data loss prevention
• Microsoft Purview Insider Risk Management
• Device onboarding overview for Microsoft Purview

Intune: Which License One Do You Actually Need?

by David | Jul 10, 2026 | Intune

Someone messaged me last week asking "what license do I actually need for this kiosk in the lobby" and I gave a confident answer that was wrong. Not because I dont know Intune, but because the licensing side of it is scattered across like four different Microsoft pages and none of them agree on vocabulary. So I went and actually sorted it out properly, and figured I'd write it down before I forget it again.

This is the "what license do I need" post. Not pricing, pricing changes constantly and I'm not going to lie to you about numbers that'll be wrong in six months. Just what each license actually covers and when you'd reach for it.

The three Intune plans

Underneath everything, Intune capability is split into three plans. Doesnt matter what bundle you bought, the docs and the admin center both talk in these terms:

• Intune Plan 1, the base service. Device enrollment, compliance policies, app protection, config profiles. This covers most of what people think of as "Intune."
• Intune Plan 2, additive on top of Plan 1. Adds things like Remote Help and Advanced Analytics.
• Intune Suite, additive on top of Plan 1 as well, and it includes everything in Plan 2. This is the one with Cloud PKI, Endpoint Privilege Management, Enterprise Application Management, that kind of thing.

Most people never buy these three directly though. They come bundled.

How you actually get it

Realistically almost nobody buys "Intune Plan 1" as a standalone SKU on purpose. You get it through one of these:

• Microsoft 365 E3, E5, or E7, commercial plans, Intune comes bundled at increasing plan levels
• Enterprise Mobility + Security (EMS) E3 or E5, this was the original way to get Intune plus Entra ID P1 or P2 without buying full Microsoft 365
• Microsoft 365 Business Premium, for the small and mid sized business crowd
• Microsoft 365 Education A3 or A5, includes Intune for Education, more on that in a second
• Microsoft 365 F1/F3, the frontline worker tiers, if your org has task workers who dont sit at a desk

If you're not sure which bundle your org has, Microsoft 365 admin center > Billing > Your products will tell you, and so will Intune admin center > Tenant administration > Tenant status > Tenant details, which shows total licensed users and total Intune licenses.

Commercial, education, and government arent the same product

Commercial is what almost everyone reading this is on. Standard Intune admin center, standard everything.

Intune for Education is a separate, simplified admin portal built for schools, at intuneeducation.portal.azure.com instead of the regular admin center. It's included with Microsoft 365 Education A3 or A5, and it trims down the enterprise-grade complexity into something a school IT person can actually manage without a full time job doing it. You can still use full Intune alongside it if you need the deeper features.

Government is its own thing entirely. GCC is actually the same commercial instance everyone else uses, just for state and local government tenants that need extra accreditation. GCC High and DoD are different, they run on a physically separate Azure Government Cloud datacenter (referred to as IL4 and IL5). You cant migrate a device between commercial and government clouds either, it has to unenroll and re-enroll clean.

Assigning the license, step by step

1. Microsoft 365 admin center > Users > Active users
2. Pick the unlicensed user
3. Licenses and apps
4. Check the box for Intune, or for the EMS bundle if thats what you're assigning, then Save changes

Schools using School Data Sync can assign Intune for Education licenses right in the SDS profile setup instead of doing it user by user.

One thing worth knowing, admins dont always need their own Intune license just to manage the service. Tenants created after July 2021 support unlicensed admin access by default, up to 1000 unlicensed admins per security group. Older tenants can turn this on manually under Tenant administration > Roles > Administrator Licensing.

The one everyone forgets: device-only licenses

This is the one that actually started this whole post. If a device isnt tied to a specific person, kiosks, dedicated devices, phone room devices, digital signage, IoT type stuff, you dont necessarily need a full per-user license for it. Intune has a device-only subscription built exactly for this.

Device licenses apply when the device enrolls through one of these paths:

• Windows Autopilot self-deploying mode
• Apple Automated Device Enrollment without user affinity
• Apple School Manager without user affinity
• Apple Configurator without user affinity
• Android Enterprise dedicated devices
• Using a device enrollment manager account

Notice that last one. Device enrollment manager accounts and device-only licenses show up together a lot, because they're both built for the same problem, devices nobody personally owns.

The tradeoff is real though. A device enrolled on a device-only license doesnt get app protection policies, doesnt get Conditional Access, and loses user-based features like email and calendar. Thats fine for a lobby kiosk showing a product catalog. Its not fine if you were hoping to quietly save money by licensing a real employee's laptop this way, that device needs a proper user license because a person is actually using it day to day.

Putting it together

If someone asks you "which Intune license do I need," the real answer is: figure out what bundle your org already has first, because you probably already own Plan 1 through Microsoft 365 or EMS without realizing it. Then check if you're education (Intune for Education, A3/A5) or government (GCC High/DoD is a separate cloud, not just a setting). Then, separately, figure out which of your devices dont belong to a person at all, because those are candidates for a device-only license instead of burning a full user license on a wall-mounted kiosk.

What can we learn as a person

I keep coming back to the device-only license thing. Its basically Microsoft admitting that not everything needs the full package. A kiosk doesnt need email, doesnt need Conditional Access, doesnt need the whole suite, it just needs the bare minimum to do its one job safely. And I think a lot of us hand out the full package to things in our life that only needed the bare minimum. Full emotional investment in a situation that only needed logistics. Full attention on a problem that just needed fifteen minutes. We license everything at Plan 2 when most of it is a device-only situation.

So where in your week are you over licensing something. What's actually just a kiosk, needing the bare minimum from you, that you keep assigning your full user license to?

Further reading

• Microsoft Intune licensing
• Assign licenses to users so they can enroll devices in Intune
• Use Microsoft Intune Suite add-on capabilities
• Microsoft Intune for US Government GCC High and DoD service description
• What is Intune for Education?
• Add device enrollment managers
• Microsoft Intune plans and pricing

Intune: Who Can Actually Enroll a Device

by David | Jul 8, 2026 | Intune

Had a client ask me last week "wait, why did MY personal phone just get a work profile pushed on it" and thats basically how this post started. They werent trying to break anything. They just enrolled a device because Intune let them. Nobody had ever told it not to.

So lets talk about who can actually enroll devices into Intune, where that gets decided, and the one setting most tenants forget even exists until something weird shows up in their device list.

The short answer

By default, in a brand new tenant, any licensed user can enroll a device into Intune. Windows, iOS, Android, macOS, doesnt matter. If they have a license that includes Intune and nobody has restricted anything, they can walk up to Settings on their phone, add a work account, and its managed.

That is rarely what you actually want. So there are two separate settings you need to know about, and people mix them up constantly.

Who's actually allowed in: MDM user scope

This one lives in Microsoft Entra, not Intune, which is why half the admins I talk to dont even know it exists. Go to Microsoft Entra admin center > Mobility (MDM and MAM) > Microsoft Intune. There you'll find MDM user scope, and it has three options: None, Some, and All.

• None means nobody auto-enrolls or gets redirected to Intune when they try to add a work account. Enrollment is effectively off tenant-wide.
• Some lets you pick specific security groups. Only members of those groups can enroll. This is what most orgs should be running, honestly.
• All is the wide open default I mentioned above.

This setting decides whether a user is even allowed in the door. Everything else in Intune is fine tuning after that.

Fine tuning who gets through: enrollment restrictions

Once someone is inside the MDM scope, Intune itself has its own restriction policies under Devices > Enrollment in the Intune admin center. Two kinds matter here.

Device platform restrictions control which operating systems and versions are allowed to enroll. Want to block personally owned Android devices but allow corporate ones? This is where that lives. Want to stop anyone showing up with an ancient iOS version? Same place.

Device limit restrictions control how many devices one person can enroll, from 1 to 15. That default limit has bailed out more than one helpdesk when a user's kid enrolled three tablets under the family Microsoft account by mistake.

Both of these are assigned to groups and evaluated by priority order, lowest number wins, with the built in "All users" restriction sitting at the bottom as the fallback. So if you create a custom restriction for a group, give it a lower priority number so it actually gets applied before the default one steps in.

Changing these settings, step by step

For MDM user scope:

1. Microsoft Entra admin center > Mobility (MDM and MAM)
2. Select Microsoft Intune
3. Set MDM user scope to Some, then pick your group (or groups)
4. Save. Give it a few minutes, Entra caches this stuff sometimes and it doesnt always apply instantly

For enrollment restrictions:

1. Intune admin center > Devices > Enrollment
2. Pick either "Enrollment device platform restrictions" or "Enrollment device limit restrictions"
3. Create a new restriction, configure what you need, assign it to a group
4. Go back to the restriction list and reorder priority so your custom one sits above the default

Forgetting that last step is probably the most common mistake I see. You build a beautiful restriction, assign it, test it, and nothing changes because the default policy is still winning on priority.

The part people actually ask me about: enrollment managers

This is the piece that trips people up when they're setting up kiosks, shared devices, digital signage, that kind of thing. Normally a device enrolls under a specific user's identity, and it counts against that user's device limit. Fine for a normal employee. Not fine when you're trying to enroll 40 lobby kiosks and none of them belong to a real person.

That's what the Device Enrollment Manager role is for. It's a special account, assigned in the Intune admin center under Devices > Enrollment > Device enrollment managers. An account with this role can enroll up to 1,000 devices without hitting the normal per-user device cap, and it isn't blocked by platform restrictions either.

The workflow usually looks like this: create a dedicated account, something like kiosk-enroll@yourtenant.com, dont give it a real mailbox or normal user permissions, just make it exist. Add it as a device enrollment manager. Then use that account to enroll all your shared kiosk hardware. Every device enrolled under it shows up tied to that account instead of a real person, which also makes cleanup way easier later when you're trying to figure out which devices are "real employee devices" versus "that thing bolted to the wall in the lobby."

A few things worth knowing before you go set this up:

• Enrollment manager accounts still need an Intune license, same as any enrolled user
• They're meant for shared and dedicated devices, not as a workaround for a regular employee who just hit their device limit
• Devices enrolled this way still get whatever compliance and config policies you'd normally assign, nothing about being enrollment manager owned exempts them from policy
• Dont delete the enrollment manager account once its enrolled devices, that breaks things for those devices

Putting it together

If you only remember one thing from this, remember there are two gates, not one. MDM user scope in Entra decides who gets in the building at all. Enrollment restrictions inside Intune decide what they're allowed to bring with them once they're in. And enrollment managers are the side door for devices that dont belong to any one person, like your kiosks.

Go check your MDM user scope setting today if you havent looked at it before. Theres a decent chance its still set to "All" from whenever the tenant was first stood up, and thats usually not a choice anyone actually made on purpose.

What can we learn as a person

I think about MDM user scope more than I probably should, because its really just a fancy way of answering "who gets access to me." Set to All, anyone with a login can walk in and start pushing things onto your device. Sound familiar? A lot of us run our own lives that way. Anyone with a phone number gets a work profile pushed straight onto our evenings. Anyone who asks gets a yes. We never set it to Some.

And then theres the enrollment manager thing, one dedicated account taking on the kiosk devices so it doesnt fall on fifteen different people's shoulders. I think thats a good model for life too honestly. Not everything needs to be YOUR device cap. Some stuff, the shared stuff, the repetitive stuff, is better handled by one clear owner instead of everybody carrying a little piece of it and nobody really owning it. That's usually where things fall through the cracks, when its everyone's job a little bit and nobody's job fully.

So what's your MDM user scope set to right now. Who's in it. And is there something in your week that really should have one clear owner instead of quietly being everyone's problem?