Help Desk · beginner

Windows Autopilot Device Enrollment with Intune

A zero-touch deployment flow — ship a sealed laptop to a remote employee and have it self-configure into your tenant on first sign-in, with compliance enforced.

Project overview

Tier-1.5 / Tier-2 help-desk roles increasingly require Intune skills as on-prem AD shrinks and cloud-managed endpoints take over. A working Autopilot demo signals you can run a modern endpoint operation, not just unbox laptops.

Real-world use case

A growing startup that ships laptops directly to remote new hires and needs them to be ready-to-use the moment the box is opened — no IT-shipped images, no manual setup.

Tools and technologies

Skills you can demonstrate

MDM, Zero-Touch Provisioning, Endpoint Compliance

Build roadmap

  1. Get an Intune trial + dev tenant
    Sign up for the M365 Developer Sandbox; it ships with Intune licenses. Verify you can reach the Intune admin center.
  2. Register a test device
    Use a spare laptop or Hyper-V VM. Capture the hardware hash (Get-WindowsAutopilotInfo) and upload it to Intune as an Autopilot device.
  3. Build the deployment profile
    Create a User-Driven Autopilot profile: hide EULA, hide privacy settings, auto-join Entra ID, assign a primary user.
  4. Write the compliance policy
    Use the AI prompt below. Require BitLocker, screen lock, OS version. Assign to All Devices.
  5. Add an Enrollment Status Page
    Configure ESP to block sign-in until apps + policies are applied. Pin Microsoft 365 apps + a default browser to deploy on first run.
  6. Reset and demo
    Wipe the test device. Power on, connect to Wi-Fi, sign in. Watch it self-configure end to end. Record this — that's your portfolio asset.

Ways to extend the project

Add a compliance policy that auto-quarantines devices missing BitLocker or running an outdated OS, plus an app-protection policy that auto-installs corporate apps on first sign-in.

How to showcase your work

Open this project in BuildersBenchBrowse Help Desk projects