Windows Autopilot registration overview

Before you deploy a device by using Windows Autopilot, register the device with the Windows Autopilot deployment service.

Successful registration requires that two processes are complete:

1. The device's unique hardware identity, known as a hardware hash, is captured and uploaded to the Windows Autopilot service.
2. The device is associated to an Azure tenant ID.

Ideally, the manufacturer, reseller, or distributor from which you purchased the devices performs both of these processes. A manufacturer or other device provider uses the registration authorization process to perform device registration on behalf of the organization.

You can also perform registration within the organization by collecting the hardware identity from new or existing devices and uploading it manually. If devices meet certain requirements, you can also configure them for automatic registration with Windows Autopilot. For more information about the ways in which devices can be registered with Windows Autopilot, see the following overview articles:

• OEM registration
• Reseller, distributor, or partner registration
• Automatic registration
• Manual registration

When you register a Windows Autopilot device, it automatically creates a Microsoft Entra object. The Windows Autopilot deployment process needs this object to identify the device before the user signs in. If you delete the object, the device can fail to enroll through Windows Autopilot.

If you don't assign a profile to a Windows Autopilot device, it receives the default Windows Autopilot profile. If a device shouldn't go through Windows Autopilot, remove the Windows Autopilot registration.

Terms

The following terms refer to various steps in the registration process:

Device identification

To identify a device with Windows Autopilot, capture the device's unique hardware hash and upload it to the service. The hardware vendor (OEM, reseller, or distributor) typically handles this step and automatically associates the device with an organization. You can also identify a device by using a harvesting process that collects the device's hardware hash from within a running Windows installation.

The hardware hash contains details about the device, such as:

• Manufacturer
• Model
• Device serial number
• Hard drive serial number
• Details about when the ID was generated
• Many other attributes that uniquely identify the device

The hardware hash changes each time you generate it because it includes details about when it was generated. When the Windows Autopilot deployment service attempts to match a device, it considers changes like that. It also considers large changes such as a new hard drive, and is still able to match successfully. But large changes to the hardware, such as a motherboard replacement, don't match, so you need to generate and upload a new hash.

For more information about device IDs, see the following articles:

• Windows Autopilot device guidelines
• Add devices to a customer account

Windows Autopilot devices

You can view devices that are registered with the Windows Autopilot service in the Microsoft Intune admin center. Go to Devices > Enrollment > Windows > Windows Autopilot > Devices:

Deregister a device

Whenever a device permanently leaves an organization, you should deregister it from Windows Autopilot. For example, the device leaves the organization for repair or because the device is at the end of its life cycle.

The following steps describe how an administrator deregisters a device from Intune and Windows Autopilot.

Delete from Intune

Before you deregister a device from Windows Autopilot, delete it from Intune. To delete a Windows Autopilot device from Intune:

1. Sign in to the Microsoft Intune admin center.

2. In the Home screen, in the left pane, select Devices.

3. In the Devices | Overview screen, under By platform, select Windows.

4. Under Device name, find the device that you want to delete and then select the device. If necessary, search for it.

5. In the properties screen for the device, note the serial number listed under Serial number.

6. After making a note of the serial number, in the toolbar at the top of the page, select Delete.

7. When the warning dialog appears, confirm the deletion of the device from Intune. Select Yes to confirm deleting the device.

Deregister from Windows Autopilot using Intune

After you delete the device from Intune, you can deregister it from Windows Autopilot. This process includes required cleanup steps in Intune and Microsoft Entra ID to prevent orphaned or unrecoverable devices. To deregister a device from Windows Autopilot:

1. Ensure the device is deleted from Intune as described in the Delete from Intune section.

2. Sign in to the Microsoft Intune admin center.

3. In the Home screen, in the left pane, select Devices.

4. In the Devices | Overview screen, under By platform, select Windows.

5. In the Windows | Windows devices screen, under Device onboarding, select Enrollment.

6. In the Windows | Windows enrollment screen, under Windows Autopilot, select Devices.

7. In the Windows Autopilot devices screen, under Serial number, find the device that you want to deregister by its serial number as determined in the Delete from Intune section. If necessary, use Search by serial number.

8. Select the device by selecting the checkbox next to the device.

9. Select the extended menu icon (…) on the far right end of the line that contains the device. A menu appears with the option Unassign user.

   • If the Unassign user option is available, select it. A warning appears confirming to unassign the user from the device. Select OK to confirm unassigning the device from the user.
   • If the Unassign user option isn't available, move on to the next step.

10. With the device still selected, in the toolbar at the top of the page, select Delete.

11. A warning appears to confirm the deletion of the device from Windows Autopilot. Select Yes to confirm deleting the device.

12. The deregistration process might take some time. To accelerate the process, in the toolbar at the top of the page, select Sync.

13. Every few minutes select Refresh in the toolbar at the top of the page until the device is no longer present.

This process ensures that related records in Windows Autopilot, Intune, and Microsoft Entra ID are handled correctly. Skipping steps or removing records out of order can result in orphaned records or unrecoverable devices. If a device goes into an unrecoverable state, contact the appropriate Microsoft support alias for assistance.

What happens to the Microsoft Entra device object after deregistration?

Deregistering a device from Windows Autopilot removes the device's registration from the Windows Autopilot deployment service. This action doesn't always remove the corresponding Microsoft Entra device object.

What happens in Microsoft Entra ID depends on the device's join and enrollment state:

• Devices that aren't currently enrolled in MDM: Removing the Windows Autopilot registration can also result in the associated Microsoft Entra device object being removed.
• Devices that are or were enrolled in MDM: Removing the Windows Autopilot registration doesn't automatically delete the Microsoft Entra device object. In this case, the device can remain in Microsoft Entra ID even though it's no longer registered with Windows Autopilot.

Because this behavior varies, avoid manually deleting the device from Microsoft Entra ID unless a specific scenario requires it. The Windows Autopilot deployment process relies on the Microsoft Entra device object, and deleting it can cause enrollment failures.

Deregister from Windows Autopilot using Microsoft 365 admin center

The device can be deregistered from Windows Autopilot in Microsoft 365 admin center if using the Microsoft 365 admin center instead of Intune. To deregister a Windows Autopilot device from the Microsoft 365 admin center:

1. Sign in to to the Microsoft 365 admin center.
2. Go to Devices > Autopilot.
3. Select the device to deregister and then select Delete device.

Deregister from Windows Autopilot in Microsoft Partner Center (MPC)

To deregister a Windows Autopilot device from the Microsoft Partner Center (MPC), a Cloud Solution Partner (CSP) would:

1. Sign in to the Microsoft Partner Center (MPC).

2. Go to Customer > Devices.

3. Select the device to be deregistered and then select Delete device.

   

When partners deregister a device from Windows Autopilot in Microsoft Partner Center (MPC), they only deregister the device from Windows Autopilot. This action doesn't perform any of the following actions:

• Unenroll the device from the mobile device management (MDM) solution, such as Intune.
• Disjoin the device from Microsoft Entra ID.

For these reasons, the manufacturer or CSP should work with the customer IT administrators to fully remove the device by following the steps in the Deregister a device section.

An OEM or CSP with integrated OEM Direct APIs can also deregister a device by using the AutopilotDeviceRegistration API. Ensure the TenantID and TenantDomain fields are left blank.

Related content

• Manually register devices with Windows Autopilot.