Autopilot Device Preparation baseline

Autopilot Device Preparation (“V2”) enforces your apps and scripts before the desktop appears, with no hardware-hash upload. This is the minimum baseline to start piloting.

Entra device group. Create a static device group (e.g. Device – Autopilot – Device Preparation Enrollment) and set its owner to the Autopilot Device Preparation service principal. Everything downstream targets this group.
Apps, scripts & naming. Assign required apps, scripts and configuration to that group. V2 has no prefix/serial naming, so deploy the Autopilot V2 Device Rename platform script:
Terminal window
```
# PREFIX + sanitised BIOS serial, max 15 chars, keeps the last 4 serial chars
.\AutopilotV2_DeviceRename.ps1 -Prefix 'YOURCO-V2' -MaxTotalLength 15 -WhatIf
```
Device preparation policy. Intune › Devices › Windows › Windows enrollment › Device preparation policies:
- Device group: the group from step 1
- Out-of-box settings, including whether the user is a local admin
- Apps & scripts to enforce during enrollment
- Entra user groups allowed to enroll
(Optional) Retro-assign a V1 profile after enrollment for consistent device actions such as Autopilot Reset.

Before you test

Blocking personal Windows enrollment? Pre-add serials as corporate device identifiers instead of uploading hashes.
Brief the helpdesk — V2’s OOBE looks a little different.
Monitor in Devices › Monitor › Windows enrollment (30-day lookback for V1 and V2).