Windows Autopilot: Choose Your Path

What is Windows Autopilot?

Autopilot vs provisioning packages

Sam at Tui Solutions is choosing between Autopilot and provisioning packages for 500 new laptops. Here’s the comparison:

Feature	Windows Autopilot	Provisioning Packages
Infrastructure needed	Internet connection only	Windows Configuration Designer (WCD) + USB/network share
Image required	No — uses the factory OS	No — uses the factory OS (but can customise settings)
Internet required during setup	Yes	No (offline capable)
IT technician needed	No — user self-service or zero-touch	Minimal — apply package via USB
Entra join	Automatic during OOBE	Can be configured in package
Intune enrollment	Automatic (via auto-enrollment)	Can be configured in package
Customisation depth	Profiles, apps, policies via Intune	Registry settings, certificates, Wi-Fi, apps
Best for	Cloud-managed devices with internet access	Kiosks, shared devices, or environments without reliable internet
Scale	Thousands of devices — fully cloud-driven	Hundreds — manual USB application per device

Key exam concept: Autopilot is the recommended approach for modern cloud-managed deployments. Provisioning packages are the fallback for offline scenarios or specialised devices (kiosks, labs) where Autopilot isn’t practical.

The three deployment modes

This is one of the most exam-tested topics in MD-102. Each mode serves a different scenario.

Autopilot Deployment Modes

Feature	User-Driven	Self-Deploying	Pre-Provisioned
Who sets up the device	The end user	Nobody — zero-touch	IT technician (Phase 1) + end user (Phase 2)
User signs in during OOBE	Yes — user authenticates	No — no user interaction	Phase 1: technician. Phase 2: user.
User affinity	Yes — device is tied to a user	No — shared device	Yes — tied to user after Phase 2
TPM 2.0 required	No (recommended)	Yes (mandatory)	Yes (mandatory)
Best for	Standard employee laptops	Kiosks, shared devices, meeting rooms	Executive devices needing pre-staging
Use case example	Sam ships laptops to remote workers who self-setup	Tui Solutions deploys conference room tablets	IT pre-installs heavy apps before giving to VIPs
Entra join type	Entra Joined or Hybrid Joined	Entra Joined only	Entra Joined or Hybrid Joined

User-driven mode (most common)

The employee receives a new laptop, opens the box, connects to Wi-Fi, and signs in with their Entra ID credentials. Autopilot handles the rest:

1. Device contacts Autopilot service
2. Custom OOBE screens shown (branded company logo, custom text)
3. User signs in → Entra join + Intune enrollment
4. Apps, policies, and profiles install
5. Device is ready to use

When to use: The default choice for standard employee devices. Works for both remote and in-office workers.

Self-deploying mode (no user needed)

The device powers on, connects to a network (wired or configured Wi-Fi), and configures itself completely without any user interaction.

1. Device contacts Autopilot service using hardware identity (TPM attestation)
2. Entra joins automatically (no user sign-in)
3. Intune enrollment and configuration
4. Device is ready for shared use

When to use: Kiosks, digital signage, shared meeting room devices, lobby check-in stations. Any device that doesn’t belong to a specific user.

Requirement: TPM 2.0 is mandatory — the device proves its identity through hardware attestation since no user authenticates.

Pre-provisioned mode (two-phase)

IT does the heavy lifting upfront, then the user finishes setup:

Phase 1 (IT technician):

1. Technician powers on the device in a staging area
2. Presses Windows key 5 times during OOBE to enter technician flow
3. Device Entra-joins and starts installing apps/policies
4. Technician verifies everything works, then reseals the device

Phase 2 (End user):

1. User receives the pre-staged device
2. Connects to Wi-Fi and signs in
3. Any remaining user-specific config applies
4. Device is ready — much faster than starting from scratch

When to use: When you need to pre-install large applications (e.g., Visual Studio, CAD software) or verify device readiness before handing to a user. Common for executives, developers, and remote workers with poor internet.

💡 Exam tip: self-deploying requires TPM 2.0

The exam specifically tests the TPM requirement for self-deploying mode. Remember:

• User-driven — TPM recommended but NOT required
• Self-deploying — TPM 2.0 required (no user authenticates, so the device must prove identity via hardware)
• Pre-provisioned — TPM 2.0 required (Phase 1 uses device attestation)

If a question describes a kiosk device without TPM 2.0, self-deploying mode will NOT work. You’d need user-driven (with a service account) or a provisioning package instead.

Sam’s Autopilot plan for Tui Solutions

Device Type	Count	Deployment Mode	Why
Employee laptops (remote workers)	300	User-driven	Shipped direct to employees, self-service setup
Employee laptops (office-based)	100	Pre-provisioned	IT pre-installs specialist consulting software
Conference room tablets	30	Self-deploying	No user — shared meeting room devices
Warehouse kiosks	20	Self-deploying	No user — inventory check-in stations
Executive laptops	50	Pre-provisioned	IT pre-stages with full app suite + verification

🎬 Video walkthrough

🎬 Video coming soon

Windows Autopilot: Choose Your Path — MD-102 Module 8

Windows Autopilot: Choose Your Path — MD-102 Module 8

~12 min

Flashcards

Question

What are the three Windows Autopilot deployment modes?

Click or press Enter to reveal answer

Answer

1. User-driven — employee self-service, most common. 2. Self-deploying — zero-touch for shared/kiosk devices. 3. Pre-provisioned — IT does Phase 1, user does Phase 2. Self-deploying and pre-provisioned both require TPM 2.0.

Click to flip back

Question

When should you use a provisioning package instead of Autopilot?

Click or press Enter to reveal answer

Answer

When devices don't have reliable internet during setup (offline deployment), for specialised kiosk configurations, or in environments where Autopilot's cloud-dependency is a limitation. Provisioning packages are created with Windows Configuration Designer and applied via USB.

Click to flip back

💡 Show hint

Question

Why does self-deploying mode require TPM 2.0?

Click or press Enter to reveal answer

Answer

Because no user signs in to authenticate, the device must prove its identity through hardware attestation via the TPM (Trusted Platform Module). Without TPM 2.0, the Autopilot service can't verify the device's identity.

Click to flip back

Question

What triggers the pre-provisioned technician flow during OOBE?

Click or press Enter to reveal answer

Answer

Pressing the Windows key 5 times during OOBE opens the technician flow for pre-provisioned deployment. The technician can then start Phase 1 (Entra join, app installation, policy application) before resealing the device for the end user.

Click to flip back

Knowledge Check

Knowledge Check

Tui Solutions needs to deploy 30 tablets for conference rooms. The tablets will display a meeting room booking app — no specific user will sign in. Which Autopilot deployment mode should Sam choose?

ASelf-deploying — zero-touch for shared devices with no user affinityBUser-driven — it's the most flexible modeCPre-provisioned — IT should verify each tablet before deploymentDAutopilot isn't suitable — use a provisioning package instead

Check Answer

Knowledge Check

Sam discovers that 20 older kiosk devices in the warehouse don't have TPM 2.0 chips. He planned to use self-deploying mode for these. What should Sam do?

AUse self-deploying mode anyway — TPM is optionalBUpgrade to user-driven mode and create a shared service account for sign-inCUse provisioning packages instead — they don't require TPMDReplace the devices — there's no alternative

Check Answer

---

Next up: Autopilot Deployment: Device Names, ESP & Rollout — the practical details of implementing Autopilot at scale.