WINDOWS AUTOPILOT

Introduction

Windows Autopilot streamlines device deployment by allowing new devices to be shipped directly to users and configured automatically upon first boot. Depending on your procurement timeline, your devices will be enrolled using one of two methods: 

This guide outlines how both processes work, their associated timelines, and the administrative requirements for each.

1. OEM/Vendor Pre-Enrollment (Standard Process)

Whenever possible, devices are registered into Windows Autopilot directly by the hardware vendor or manufacturer prior to delivery.

• How It Works: The hardware vendor links the device hardware IDs directly to your organization's Microsoft tenant at the point of fulfillment.

• Lead Time: Requires an additional 4–5 week lead time from the vendor to process and register the stock.

• Client Action Required: None. Devices arrive ready for your users to unbox and log in.

• Best Suited For: Standard, planned hardware refreshes where timeline flexibility allows for the 4–5 week fulfillment window.

2. Manual Hash ID Extraction (Expedited Process)

When devices must be procured quickly to meet tight onboarding deadlines, we bypass the vendor pre-enrollment queue to secure available stock immediately. This requires manual enrollment.

• How It Works: Our deployment team unboxes the hardware in a secure lab environment, boots the device into a temporary command interface, and extracts a unique hardware identifier called a Hardware Hash ID.

• Lead Time: Fast-tracked. Allows devices to be prepared and shipped within days instead of weeks.

• Security & Admin Requirements: To protect your environment's integrity and adhere to strict security boundaries, our team operates under the following framework:

• No Tenant Access Required: Our team does not request or require Administrator access to your Microsoft console.

• Upload Options: Once Hash IDs are extracted, they can be delivered to your Autopilot console in one of two ways:

• Client-Led Upload (Default): Our team provides you with a secure CSV file containing the extracted Hash IDs. Your internal IT team then uploads this file directly into your Microsoft Intune/Autopilot console to complete the enrollment.

• Esevel-Led Upload (New – Delegated Access): If preferred, you can instead provision our team with a dedicated, least-privileged account. This account is scoped to three permissions only — upload hash details, view uploaded hashes, and view users — with no other tenant access granted. Our team then uploads the Hash IDs directly on your behalf, removing the need for your IT team to handle the file. 

Note: Contact your account team to learn more about setting this up.

• Best Suited For: New hire onboardings, urgent replacements, or any scenario where the standard 4–5 week lead time is not feasible.

📌 Note for Project Managers & Clients

When planning asset procurement, please align with your account team on whether your timeline prioritizes expedited delivery (Manual Hash) or zero-touch automation (Vendor Enrollment).

📌 New: Delegated Upload Access

If your organization would prefer that our team upload Hash IDs directly, rather than routing them through your IT team via CSV, we can be granted a dedicated, least-privileged account limited to uploading hash details, viewing uploaded hashes, and viewing users. Reach out to your support team for more information on setting this up.