Create device groups for Windows Autopilot

Create a Windows Autopilot device group using Intune

1. In the Microsoft Intune admin center, select Groups > New group.

2. In New Group, configure the following properties:

   • Group type: Select Security.

   • Group name and Group description: Enter a name and description for the group.

   • Microsoft Entra roles can be assigned to the group: Select No, Microsoft Entra roles aren't assigned to this group.

     For more information, see Use cloud groups to manage role assignments in Microsoft Entra ID.

   • Membership type: Select how devices become members of this group. Select Dynamic Device. For more information, see Add groups to organize users and devices.

   • Owners: Select users that own the group. Owners can also delete this group.

   • Dynamic device members: Select Add dynamic query > Add expression.

     Create rules using Windows Autopilot device attributes. Windows Autopilot devices that meet these rules are automatically added to the group.

     Note

     You should only create groups using the Autopilot device attributes, which are available only on registered devices. Creating an expression using non-Windows Autopilot attributes doesn't guarantee that devices will be members of the group before provisioning and could result in unexpected configuration during OOBE.

     When creating expressions:

     • To create a group that includes all of the Windows Autopilot devices, enter: (device.devicePhysicalIDs -any (_ -startsWith "[ZTDid]")).
     • Intune's group tag field maps to the OrderID attribute on Microsoft Entra devices. To create a group that includes all Windows Autopilot devices with a specific group tag (the Microsoft Entra device OrderID), enter: (device.devicePhysicalIds -any (_ -eq "[OrderID]:179887111881")).
     • To create a group that includes all the Windows Autopilot devices with a specific Purchase Order ID, enter: (device.devicePhysicalIds -any (_ -eq "[PurchaseOrderId]:76222342342"))

     Save the expressions.

3. Select Create.

For a detailed tutorial on creating a device group for each of the Windows Autopilot scenarios using Intune, see the following resources:

• User-driven Microsoft Entra join: Create a device group
• User-driven Microsoft Entra hybrid join: Create a device group
• Pre-provision Microsoft Entra join: Create a device group
• Pre-provision Microsoft Entra hybrid join: Create a device group
• Self-deploying mode: Create a device group

Add devices

The dynamic device group that includes Windows Autopilot devices automatically adds existing Windows Autopilot devices to the device group. To manually add new devices as Windows Autopilot devices by using a CSV file so they become part of the device group, see Manually register devices with Windows Autopilot.

Assign a user to a specific Windows Autopilot device

You can assign a licensed Intune user to a specific Windows Autopilot device. For supported manufacturers, this assignment:

• Prepopulates the Microsoft Entra user Principal Name (UPN) under the pre-provisioning landing page and Microsoft Entra sign-in page.
• Enables setting a custom greeting name.

For more information, including a list of supported manufacturers, see Return of key functionality for Windows Autopilot sign-in and deployment experience.

1. Sign in to the Microsoft Intune admin center.

2. In the Home screen, in the left pane, select Devices.

3. In Devices | Overview, under By platform, select Windows.

4. In Windows | Windows devices, under Device onboarding, select Enrollment.

5. In Windows | Windows enrollment, under Windows Autopilot, select Devices.

6. In Windows Autopilot devices, select a device, and then in the toolbar select Assign user.

7. Select a Microsoft Entra ID user licensed to use Intune and select Select.

8. In User Friendly Name, enter a friendly name or accept the default.

9. Select Save.

For a detailed tutorial on assigning a user for each of the Windows Autopilot scenarios by using Intune, see the following articles:

• User-driven Microsoft Entra join: Assign Windows Autopilot device to a user
• User-driven Microsoft Entra hybrid join: Assign Windows Autopilot device to a user
• Pre-provision Microsoft Entra join: Assign Windows Autopilot device to a user
• Pre-provision Microsoft Entra hybrid join: Assign Windows Autopilot device to a user

Using Windows Autopilot in other portals

If you're not interested in mobile device management (MDM), you can use Windows Autopilot in other portals. While using other portals is an option, only use Intune to manage Windows Autopilot deployments. When you use Intune with another portal, Intune can't:

• Display changes to profiles that you create in Intune but edit in another portal.
• Synchronize profiles that you create in another portal.
• Display changes to profile assignments that you make in another portal.
• Synchronize profile assignments that you make in another portal.
• Display changes to the device list that you make in another portal.

Windows Autopilot for existing devices

When you enroll Windows devices through Windows Autopilot for existing devices, use a correlator ID to group the Windows devices. The correlator ID is a parameter of the Windows Autopilot configuration file. The Microsoft Entra device attribute enrollmentProfileName automatically sets to OfflineAutopilotprofile-<correlator ID>. You can create arbitrary Microsoft Entra dynamic groups when you use the correlator ID from the enrollmentprofileName attribute.

If you want all devices in the groups to automatically register to Windows Autopilot, set the Convert all targeted devices to Autopilot setting to Yes in any Windows Autopilot profiles assigned to the groups. All non-Windows Autopilot devices in assigned groups register with the Windows Autopilot deployment service. Allow 48 hours for the registration to be processed.

When you unenroll and reset the device, Windows Autopilot enrolls it again. After you register a device in this way, disabling this setting or removing the profile assignment doesn't remove the device from the Windows Autopilot deployment service. You must remove the device by deregistering the device from Windows Autopilot. For more information about how to properly deregister a device, see Deregister a device.

For a full tutorial on Windows Autopilot for existing devices, see the following article:

• Step by step tutorial for Windows Autopilot deployment for existing devices in Intune and Configuration Manager

Next steps

After you create a device group, configure a Windows Autopilot deployment profile and deploy it to each device in the group. Deployment profiles determine the deployment mode, and customize the OOBE for the end users. For more information, see Configure deployment profiles.

For a detailed tutorial on configuring and assigning a Windows Autopilot deployment profile, see the following articles. Each article has detailed instructions on configuring and assigning a Windows Autopilot deployment profile in Intune for each of the Windows Autopilot scenarios:

• User-driven Microsoft Entra join: Create and assign user-driven Microsoft Entra join Windows Autopilot profile
• User-driven Microsoft Entra hybrid join: Create and assign user-driven Microsoft Entra hybrid join Windows Autopilot profile
• Pre-provision Microsoft Entra join: Create and assign a pre-provisioned Microsoft Entra join Windows Autopilot profile
• Pre-provision Microsoft Entra hybrid join: Create and assign a pre-provisioned Microsoft Entra hybrid join Windows Autopilot profile
• Self-deploying mode: Create and assign self-deploying Windows Autopilot profile

For more information about managing Windows Autopilot devices, see What is Microsoft Intune device management?