Skip to content 
Windows Autopilot
With Windows Autopilot, many companies set up new notebooks without touching them beforehand: the device goes straight to the employee who signs in, and the rest runs automatically. At the end of the life cycle, the advantage reverses. A device that is still registered in Autopilot remains tied to your company – even after erasure. This glossary entry explains how Autopilot works and what you must do before selling or handing over.
In brief
Windows Autopilot is a Microsoft cloud service with which companies automatically set up new or reset Windows devices. For this, each device is registered with the company via a unique hardware identifier and supplied with its settings at first start. Before sale or handover, this registration must be removed, otherwise the device remains assigned to the previous company.
What is Windows Autopilot?
Windows Autopilot replaces classic setup with a company image of its own. Instead of preparing each device by hand, IT uses the Windows version that is already preinstalled. At first start, the device contacts Microsoft. If the service recognizes the device as the property of a company, it displays that company's sign-in page and transfers the defined settings.
Autopilot works closely with Microsoft Entra ID (formerly Azure Active Directory) and a management system for end devices, usually Microsoft Intune. Such a system is called Mobile Device Management (MDM). Autopilot provides the onboarding, and the MDM then manages the device in everyday use.
How Autopilot works
- Registration: The device's hardware identifier, the so-called hardware hash, is stored in the company's Microsoft account (tenant). This is done by the manufacturer, a reseller or the company's own IT, for example by importing a list.
- Profile: IT assigns a deployment profile to the device. It defines how the setup proceeds.
- First start: The device connects to the internet and queries Autopilot. It displays the company's sign-in page.
- Sign-in and enrollment: After signing in with the company account, the device joins Entra ID and is registered in the MDM.
- Configuration: Policies, apps and certificates are installed automatically.
There are also variants: in self-deploying mode, a device sets itself up without user sign-in; in pre-provisioning, a partner prepares the devices. Both variants presuppose a TPM 2.0 . With "Autopilot Reset", a device can be reset and prepared for a new person in the company. Microsoft also offers the newer variant "Windows Autopilot device preparation", which registers differently. Check which variant your company uses.
What to note when retiring devices
The registration is tied to the hardware, not to the hard drive. A device can also only be registered in one tenant at a time. If it is erased or reinstalled, the assignment remains. If a new owner starts the device with an internet connection, in the worst case they see your company's sign-in page and cannot set up the device as usual. Microsoft therefore recommends always deregistering devices from Autopilot when they leave the company permanently – also for a repair or at the end of the life cycle.
| Where the device is registered | What to do before handover | Consequence if it is forgotten |
|---|---|---|
| MDM (e.g., Intune) | Delete the device or take it out of service | Device keeps appearing in your management; deregistration from Autopilot is blocked |
| Windows Autopilot | Remove the device from the Autopilot device list (deregistration) | Device remains assigned to your tenant; new owner cannot set it up freely |
| Microsoft Entra ID | Remove the device object | Outdated entries in the directory |
| Data carrier | Certified erasure, destruction if defective | Company data remains recoverable |
Microsoft describes the order like this: first delete the device in the MDM, then deregister it from Autopilot. Only your company can perform the deregistration in its own tenant. A service provider cannot do this for you.
Rule of thumb: Erasure removes the data, but not the registration. A device is only free once it has also been deregistered from Autopilot.
Typical mistakes
- Devices are sold before IT has deregistered them from Autopilot.
- Deregistration fails because the device was not deleted from the MDM beforehand.
- A list of serial numbers is missing, so nobody knows which devices are still registered.
- A factory reset is confused with a secure erasure. The factory reset does not replace certified data erasure.
- After a mainboard replacement, the registered hardware identifier no longer matches, and the device remains as a "zombie" in the tenant.
Example: return of 80 notebooks
A simplified example shows a clean process. A company replaces 80 notebooks that were all set up via Autopilot.
- IT exports a list of serial numbers from the MDM and reconciles it with the devices collected.
- The devices are deleted in the MDM and then deregistered from Autopilot.
- The device objects in Entra ID are removed.
- The notebooks are handed over sealed to the service provider, erased there with certification and documented with an erasure certificate per serial number.
- The devices are free of data and bindings and can be refurbished and resold.
Two devices are missing in the reconciliation. They remain registered for now until it is clarified where they are. This way, IT does not release a device whose whereabouts are unclear.
Windows Autopilot at Second IT
Second IT übernimmt den Teil, der nach der Abmeldung folgt. Die Geräte werden mit eigener Sicherheitslogistik abgeholt, im Wareneingang per Seriennummer registriert und mit Blancco gelöscht. Für jedes Gerät gibt es ein digital signiertes Löschzertifikat. Alle Identifikationsmerkmale Ihres Unternehmens werden entfernt, damit sich der Ursprung nicht zurückverfolgen lässt. Bei der Aufbereitung werden alte Daten und Software vollständig entfernt und aktuelle Betriebssysteme installiert. Planen Sie die Abmeldung aus Autopilot und MDM deshalb vor der Abholung ein. Mehr zur certified data deletion.
Distinction from related terms
Autopilot is not an MDM but a provisioning service. It brings the device into management; actual control is taken over by Intune or another MDM. With Re-imaging a complete system image is installed; Autopilot dispenses with that. For Apple devices, the Apple Business Manager performs a similar task; for Android, the zero-touch enrollment. How computers are sold after the end of Windows 10 is explained in our guide Selling used PCs. How devices come back securely when employees leave is shown by the offboarding checklist.
Frequently asked questions about Windows Autopilot
Is it enough to reset an Autopilot device?
No. A reset neither erases the data securely nor removes the registration. The device remains assigned to your tenant. Deregister it from the MDM and Autopilot and have the data carriers erased with certification.
Who can deregister a device from Autopilot?
Only administrators of the tenant in which the device is registered. A buyer or service provider has no access to it. That is why deregistration is one of your IT's tasks before handover.
In what order do I deregister a device?
According to Microsoft, first delete it in the MDM, for example in Intune, and then remove it from the Autopilot device list. Afterwards you can remove the device object in Entra ID.
What happens if I forget the deregistration?
When setting up, the new owner may see your sign-in page and cannot use the device freely. This reduces its value and can trigger queries. Subsequent deregistration is possible as long as you know the serial number.
What is the difference between Windows Autopilot and Intune?
Autopilot is a provisioning service that brings a device into management at first start. Intune is a management system for end devices (MDM) that then controls the device in everyday use. Both work closely together.
Notebooks deregistered? We erase with certification and give them a second life.
Send us your device list. You will receive your offer in 48 hours on average.