Windows Autopilot Device Association: A Step-by-Step Setup Guide
Bind Windows devices to your tenant before enrollment using UEFI and TPM-backed identity — now generally available in Intune.
What it is and why it matters
Windows Autopilot device association binds a Windows device to your organization before it enrolls in Intune. It writes a tenant-affinity marker into the device’s UEFI firmware, backed by the device’s TPM identity. The feature reached general availability in the August 2026 Intune release.
- Streamlined out-of-box experience (OOBE)
- Device naming before enrollment
- Device-based policy targeting
- Automatic corporate marking
- Hardware-attested onboarding security
What you’ll need
- A Microsoft Intune tenant with Microsoft Entra ID P1 or P2
- Target devices on Windows 11 24H2 or later with TPM 2.0
- An account with the Intune Administrator role (or a custom role with enrollment-program permissions)
- A Windows Autopilot device preparation policy (created in Step 1)
Step 1 — Create a device preparation policy
- Sign in to the Microsoft Intune admin center.
- Go to
Devices > Windows > Enrollment. - Under Windows Autopilot device preparation, select Device preparation policies.
- Select Create and choose User Driven.
- Name the policy, pick the device security group, and set User account type, Language/Region and Keyboard layout.
- On the Apps page select up to 25 required apps.
- Assign the policy to your users or devices and select Create.
Step 2 — Export device information during OOBE
On the new device, boot to OOBE and connect it to the network. Use the on-screen option to export device information — this produces a CSV containing the device’s TPM-backed identity. Copy the CSV to a machine that can reach the Intune admin center.
Step 3 — Pre-associate the device in Intune
- Go to
Devices > Enrollment > Device association. - Choose to pre-associate a device and upload the exported CSV.
- Optionally assign a device preparation policy directly to the device.
Step 4 — Association and enrollment
When the device connects to the network during OOBE, it presents its TPM-backed identity. Intune verifies it and writes the tenant-affinity marker to UEFI. The user then signs in with their Microsoft Entra ID account, and the device enrolls with the correct name, corporate marking and assigned policy.
Step 5 — Monitor association state
Go to Devices > Enrollment > Device association > Devices to review each device’s association state and assigned policy. Filter by state, policy, manufacturer or model.
To remove an association (decommissioned or transferred device), run the documented PowerShell script on the device to clear the UEFI marker.
Verify it works
- The device shows Associated in
Device association > Devices. - The device appears in Intune as corporate-owned with no separate corporate identifier upload.
- The correct device name is present before enrollment completes.
Troubleshooting notes
Confirm TPM 2.0 is enabled in firmware and the device runs Windows 11 24H2 or later.
If the device is already registered in legacy Autopilot (Devices > Windows > Enrollment > Devices), deregister it first.
Device preparation currently supports Microsoft Entra join (user-driven) and automatic mode for Windows 365.