Provisioning Packages & Windows 11 Upgrades
When Autopilot isn't an option, provisioning packages offer offline device setup. Plus: planning and implementing Windows 11 upgrades for existing devices.
Provisioning packages
Think of a provisioning package like a recipe card you hand to a new cook.
Instead of teaching them every step from scratch (Autopilot’s approach), you give them a card with all the instructions pre-written. They plug in a USB drive, the device reads the instructions, and sets itself up — even without internet. It’s not as elegant as Autopilot, but it works when you can’t rely on a network connection.
Creating a provisioning package
Tool: Windows Configuration Designer (WCD) — available from the Microsoft Store or as part of the Windows ADK.
| Step | What You Do |
|---|---|
| 1. Choose a project type | Simple provisioning (wizard) or advanced provisioning (full control) |
| 2. Configure settings | Device name, Entra join, Wi-Fi, certificates, shared device mode |
| 3. Add apps (optional) | Include .msi or .exe installers in the package |
| 4. Build the package | Export as a .ppkg file |
| 5. Apply the package | USB drive during OOBE, or double-click the .ppkg file on a running device |
When provisioning packages beat Autopilot
| Scenario | Why Provisioning Package Wins |
|---|---|
| No internet during setup | Packages work offline — Autopilot requires internet |
| Factory floor kiosks | Pre-configured USB applied to dozens of identical devices |
| Shared lab computers | Bulk setup with identical config, no user sign-in needed |
| Legacy devices without TPM | Packages don’t require TPM — self-deploying Autopilot does |
| Quick one-off setup | Faster to create a package than register devices in Autopilot |
Exam tip: provisioning packages and security
Provisioning packages can include sensitive data like Wi-Fi passwords and certificates. Keep these secure:
- Packages can be encrypted and signed with a certificate
- Without encryption, anyone with the USB drive can extract the settings
- Without signing, a tampered package could configure malicious settings
The exam may ask about securing provisioning packages — the answer involves encryption and certificate signing.
Windows 11 upgrades
Aroha at CloudForge has 30 devices running Windows 10 that need upgrading to Windows 11. There are several paths, and the right choice depends on the scenario.
Upgrade methods
| Feature | Feature Update (Intune) | Windows Update for Business | In-Place Upgrade (ISO) | Autopilot Reset |
|---|---|---|---|---|
| Managed via | Intune feature update policy | Update rings in Intune | Manual ISO or SCCM task sequence | Intune remote action |
| User data preserved | Yes | Yes | Yes (in-place) or No (clean) | No — full reset |
| Apps preserved | Yes | Yes | Yes (in-place) or No (clean) | No — reinstalled via Intune |
| Internet required | Yes | Yes | No (ISO can be local) | Yes |
| Best for | Targeted feature updates to specific groups | Broad update management with rings | Legacy devices or offline upgrades | Starting fresh on cloud-managed devices |
| Admin effort | Low — policy-driven | Low — automated | High — manual or scripted | Low — remote action |
Feature update policies in Intune
The most common cloud-managed approach:
- Intune admin center → Devices → Manage updates → Windows 10 and later updates → Feature updates
- Create a policy specifying the target Windows version (e.g., Windows 11, version 24H2)
- Assign to a device group
- Devices download and install the feature update automatically
Hardware compatibility
Before upgrading, verify devices meet Windows 11 requirements:
| Requirement | Minimum |
|---|---|
| Processor | 1 GHz, 2+ cores, 64-bit |
| RAM | 4 GB |
| Storage | 64 GB |
| TPM | Version 2.0 |
| Secure Boot | UEFI with Secure Boot |
| Display | 9 inches, 720p |
| Graphics | DirectX 12 with WDDM 2.0 |
Deep dive: Windows 11 readiness with Intune
Intune can help assess Windows 11 readiness:
- Endpoint Analytics shows which devices meet Windows 11 hardware requirements
- Windows Update compatibility holds prevent upgrades on devices with known compatibility issues
- Gradual rollout using update rings lets you upgrade pilot groups first, then broader waves
Aroha’s approach at CloudForge:
- Check Endpoint Analytics for compatibility (28 of 30 devices qualify)
- Upgrade 5 pilot devices (IT team) using a feature update policy
- Wait one week, verify no issues
- Roll out to remaining 23 devices
- Replace 2 incompatible devices with new hardware
🎬 Video walkthrough
🎬 Video coming soon
Provisioning Packages & Windows 11 Upgrades — MD-102 Module 10
Provisioning Packages & Windows 11 Upgrades — MD-102 Module 10
~11 minFlashcards
Knowledge Check
Aroha needs to set up 10 kiosk devices in a warehouse with no Wi-Fi access. The devices should join Entra ID and enroll in Intune when they next connect to the internet. What's the best deployment method?
Sam wants to upgrade 500 Windows 10 devices to Windows 11 using Intune. He wants to upgrade the IT team first, then finance, then everyone else over three weeks. What should Sam configure?
Next up: Windows 365: Your PC in the Cloud — deploying and managing Cloud PCs for remote and flexible work.