Microsoft now recommends Autopilot Device Preparation for user-driven Windows Autopilot deployments, and most future investment will go there. Before you move a single device, run an Autopilot readiness assessment. It shows which Windows devices, Microsoft Intune settings and Microsoft Entra ID groups are ready today, and which ones will break enrollment if you move too soon.
This guide gives you a 10-point Autopilot readiness assessment you can score yourself in about 15 minutes. Each question maps to a real requirement or limit in Autopilot Device Preparation (sometimes called Autopilot v2). At the end, your score tells you whether to start a pilot group, fix a few blockers first, or keep your current Autopilot deployment profile for now.
Classic Windows Autopilot is not being retired. Both models can run side by side, so you can move eligible devices in controlled waves.
What Changes with Autopilot Device Preparation
Autopilot Device Preparation replaces the separate Autopilot deployment profile and Enrollment Status Page with a single device preparation policy. Enrollment Time Grouping places each device into the right Entra ID security group during the Out-of-Box Experience (OOBE), so you no longer need the hardware hash or pre-created dynamic groups. A new Device Preparation page shows users their progress, and admins get near real-time dashboards for every deployment.
The trade-off is scope. Device preparation supports fewer scenarios today, which is why an Autopilot readiness assessment matters.
| Area | Classic Windows Autopilot | Autopilot Device Preparation |
| Deployment modes | User-driven, pre-provisioned, self-deploying, existing devices | User-driven, automatic (Windows 365) |
| Join type | Microsoft Entra join or hybrid join | Microsoft Entra join only |
| Operating system | Supported Windows 10 and Windows 11 | Windows 11 22H2 or 23H2 with KB5035942 or later, or 24H2+ |
| Device registration | Hardware hash upload required | Not required |
| Apps during OOBE | Up to 100 | Up to 25 essential apps |
| PowerShell scripts during OOBE | More than 10 | Up to 10 |
| LOB and Win32 apps together | No | Yes |
| Progress screen | Enrollment Status Page | Device Preparation page |
| Group targeting | Pre-created groups | Enrollment Time Grouping |
| Reporting | Not real-time | Near real-time |
Before You Start: Access You Need
You can complete this assessment with read-only access. Nothing below changes your tenant.
Microsoft Entra role: Global Reader covers most checks. Security Reader or Security Operator works for Conditional Access and security baselines. To script the checks with PowerShell, read-only API access through Microsoft Graph works too.
Microsoft Intune admin center: read access to devices, apps, Device Configuration profiles and Device Compliance policies.
Licensing: confirm your users hold Microsoft Intune and Microsoft Entra ID P1 licenses, which are included in most Microsoft 365 business and enterprise plans.
When you’re ready to make changes, you’ll need a role such as Intune Administrator or Devices Administrator. Keep the Security Administrator and Conditional Access Administrator roles limited to the people who manage those policies.
The 10-Point Autopilot Readiness Assessment
Give yourself 1 point for every “yes.” Answer for the group of devices you want to move first, not your whole fleet.
Are the target devices running a supported Windows 11 build? Device preparation needs Windows 11 22H2 or 23H2 with KB5035942 or later, or 24H2 and above. In the Intune device hardware inventory, the TPM should show TPM present, TPM Enabled and TPM ready (TPM 2.0). Windows 10 devices must stay on classic Autopilot.
Are the devices Microsoft Entra joined, not hybrid joined? Device preparation supports Entra join only. Hybrid-joined devices need to stay on their current Autopilot deployment profile.
Is automatic MDM enrollment turned on for these users? Devices must become MDM-enrolled in Microsoft Intune during OOBE without manual steps, and your Device type restrictions must allow Windows enrollment.
Can you limit setup to 25 essential apps or fewer? Only essential apps install during OOBE, such as Microsoft 365 Apps for enterprise (on Current Channel or Monthly Enterprise Channel), OneDrive, Microsoft Teams, your VPN and security agents. Everything else installs after the user reaches the desktop, through normal assignments or the Company Portal.
Can your setup PowerShell scripts be cut to 10 or fewer? They must be Platform Scripts that run in System context.
Do you avoid pre-provisioning and self-deploying mode for these devices? Device preparation doesn’t support pre-provisioned (formerly White Glove) or self-deploying deployments today.
Can you create a device security group owned by the Intune Provisioning Client? Enrollment Time Grouping adds devices to this group during setup, so apps and policies assigned to your Entra ID security groups apply right away.
Will your Conditional Access policies allow enrollment? Users must be able to complete multi-factor authentication (2-factor authentication) during OOBE. Policies that require a compliant device should exclude the enrollment step, and your Device Compliance policies should not block a new device before it finishes setup.
Are these devices free of classic-only needs? Device preparation doesn’t support Autopilot Reset, DFCI firmware management, co-management at enrollment, Teams Rooms or HoloLens.
Do you have a pilot group ready? You need 10 to 25 users who will test and report issues. Also plan for devices already registered with a hardware hash, since the classic Autopilot profile takes precedence unless the device is associated for device preparation.
Score Your Results
Add up your points to see where your devices stand.
Ready to pilot
Build your device preparation policy and move your pilot group this month.
Fix a few blockers first
You’re close. Most gaps are app counts, scripts or Conditional Access exclusions.
Keep classic Autopilot for now
Your devices depend on features device preparation doesn’t support yet. Plan a redesign before you migrate.
Get your answers turned into a readiness report.
Not sure how to answer a question? That usually means it needs a closer look, and a guided Autopilot assessment can help. Our free review walks through your answers with you and turns them into a readiness report with actionable insights.
Common Blockers and Remediation Strategies
These are the gaps we see most often when we run an Autopilot readiness assessment with clients.
Microsoft’s advice is to avoid a one-for-one copy of your old setup. Decide what each device population needs, redesign your group assignments, and validate each wave before you expand.
Beyond Devices: Pair It with a Copilot Readiness Assessment
New Windows 11 devices are often the moment users first get Microsoft 365 Copilot. If Copilot is on your roadmap, run a Copilot readiness assessment alongside your Autopilot readiness assessment, because the device is only half the picture.
Licensing: confirm your Microsoft 365 licenses cover both Intune and Copilot for the users in each wave.
Data security: check that sensitivity labels, data loss prevention and access controls in Microsoft Purview protect sensitive content in SharePoint and OneDrive. Review your Purview controls and compliance settings as part of your wider security and compliance posture.
Data governance: run a permission audit, then clean up ROT (redundant, obsolete and trivial) files, overshared links and guest access for any external user before Copilot can surface them. A clear Information Architecture makes your data estate easier to govern.
User adoption: plan short training for each wave so users see ROI from their new device and from Copilot in the first week.
An online readiness assessment tool or automated readiness assessment can flag gaps, but no readiness assessment tool replaces a review of your actual tenant. Our free review can cover device and Copilot readiness in the same session.
Frequently Asked Questions
What is an Autopilot readiness assessment?
It’s a review of your Windows devices, Microsoft Intune configuration and Microsoft Entra ID setup. It checks whether they meet the requirements for Autopilot Device Preparation before you migrate.
Is classic Windows Autopilot being retired?
No. Microsoft recommends device preparation for user-driven scenarios, but both models can run side by side. Any single device can only use one of them.
Do I still need to upload the hardware hash?
Not for device preparation. Devices can optionally be associated with your tenant before enrollment for corporate ownership and direct policy assignment.
Can Windows 10 devices use Autopilot Device Preparation?
No. It requires Windows 11, version 22H2 or later with the required update.
How long does a migration take?
A pilot wave can be ready in a few weeks. Larger fleets usually move in several waves over a few months, depending on app counts and how many devices rely on hybrid join.
No readiness assessment tool replaces a review of your actual tenant.
Our free review covers device and Copilot readiness in the same session, and turns your answers into a readiness report with actionable insights.
