Skip to main content

Autopilot Onboarding by TechHub

Audience: TechHub IT Operations, distributed unit administrators

Purpose: Manual Autopilot enrollment when vendor provisioning fails

Quick Reference​

StepAction
1Verify OOBE screen for TAMU branding
2Sign in with Device Enrollment Manager account
3Wait for dynamic group enrollment (up to 24 hours)
4Manually sync Autopilot if needed
5Issue wipe command via Intune
6Confirm TAMU branding and hand over device

Overview​

This procedure outlines the process for manually enrolling devices into Windows Autopilot when vendor-based zero-touch enrollment has not occurred. It ensures consistency, compliance, and minimizes provisioning delays.

Scope​

Applies to all Windows devices acquired and distributed by the TechHub group at Texas A&M University where OOBE is not TAMU branded, indicating absence from Autopilot via vendor provisioning.

Prerequisites​

  • Access to Device Enrollment Manager service account
  • Secondary NetID account for Intune access
  • Understanding of dynamic group membership in Entra ID
  • Familiarity with Windows Autopilot

Procedure​

Step 1: Verify Autopilot Status​

Power on the device and observe the Out-of-Box Experience (OOBE) screen:

  • TAMU branding present → Device is vendor-enrolled and ready for distribution
  • No TAMU branding → Continue with manual enrollment process
Alternative Verification

You can verify Autopilot status by searching for the device's serial number in: Intune Portal → Devices → Windows → Windows enrollment → Devices

Step 2: Sign in to Device​

  1. Select Work or school account option during OOBE
  2. Sign in with the Device Enrollment Manager service account
  3. This initiates enrollment into Intune
Important

Do not use your personal NetID for this step. The Device Enrollment Manager account has specific permissions for device enrollment.

Step 3: Wait for Dynamic Group Enrollment​

After signing in, the device needs to be picked up by the dynamic group:

  • Allow up to 24 hours for automatic Autopilot enrollment
  • The dynamic group membership triggers profile assignment

Step 4: Manual Sync (Optional)​

To expedite the process without waiting 24 hours:

  1. Open a browser on a separate computer
  2. Sign into Intune Portal using a secondary NetID account (not the service account)
  3. Navigate to Devices → Windows → Windows enrollment → Devices
  4. Click Sync to trigger Autopilot profile assignment
Sync Duration

Manual sync can take 15 minutes to several hours depending on cloud service workload. Be patient and check periodically.

Step 5: Initiate Device Reset​

Once the device appears in Autopilot:

Option A: Wipe via Intune Portal

  1. Navigate to Devices → Windows → [Device Name]
  2. Click Wipe to reset the device

Option B: Wipe via Company Portal App

  1. Open Company Portal on the device
  2. Locate the device
  3. Select Reset or Wipe

Step 6: Verify and Hand Over​

After wipe and restart:

  1. Confirm OOBE screen now displays TAMU branding
  2. Device is Autopilot-enabled and ready for end-user distribution
  3. Document the enrollment in your asset tracking system

Example Scenario​

A Lenovo laptop is received with no TAMU branding at OOBE. TechHub uses the Device Enrollment Manager service account to sign in, waits for the device to appear in Intune, triggers a manual sync with a secondary NetID, then wipes the device once the Autopilot profile appears. After restart, TAMU branding confirms successful enrollment.

Troubleshooting​

IssueResolution
Device not appearing in Autopilot after 24 hoursVerify dynamic group rule matches device; check serial number format
Sync button grayed outWait 10 minutes between sync attempts; verify permissions
TAMU branding still missing after wipeRe-verify Autopilot registration; check deployment profile assignment
DEM account sign-in failsVerify account credentials; check conditional access policies