How to Configure Microsoft Intune Windows Autopilot for Pre-Provisioned Deployment (White Glove)

The standard Windows Autopilot deployment model is “User-Driven.” The IT department ships a factory-fresh laptop directly to the remote employee. When the employee turns it on and connects to Wi-Fi, Autopilot takes over, binds the machine to Microsoft Entra ID, and downloads all the corporate apps and policies via Microsoft Intune.

While conceptually brilliant, User-Driven Autopilot has a massive flaw: large applications (like Adobe Creative Cloud or AutoCAD) take hours to download over residential Wi-Fi. The employee sits idle, staring at the Enrollment Status Page (ESP), killing productivity.

The solution is Windows Autopilot for Pre-Provisioned Deployment (historically known as White Glove). This allows IT staff (or the OEM hardware vendor) to pre-load all the heavy lifting—applications, security policies, and device configurations—before the laptop is shipped to the end-user. When the user finally receives the device, they only experience a rapid, 5-minute login process.

This guide details the architecture of Pre-Provisioning and how to configure Intune to support it.

Understanding Pre-Provisioned Architecture

Pre-Provisioned Autopilot splits the deployment process into two distinct phases:

1. The Technician Flow: An IT technician unboxes the device, connects it to Ethernet, and powers it on. At the first Windows Out-Of-Box Experience (OOBE) screen, they press a specific key combination (Windows Key + 5). The device enters the Technician Flow, pulling down the Autopilot profile, applying all device-targeted Intune policies, and installing all device-targeted Win32 applications. The technician then shuts the device down and ships it to the user.
2. The User Flow: The end-user receives the device, powers it on, and connects to Wi-Fi. The heavy applications are already on the disk. They log in with their Entra ID credentials. Intune quickly applies any user-specific policies (e.g., OneDrive Known Folder Move) and drops them onto a fully functional desktop in minutes.

Prerequisites for Pre-Provisioning

To execute the Technician Flow, your environment must meet these requirements:

• Hardware: Physical TPM 2.0 and Device Attestation support. (Virtual Machines generally fail White Glove attestation).
• OS: Windows 10 (version 1903 or later) or Windows 11.
• Network: Ethernet is highly recommended for the Technician flow to avoid Wi-Fi driver issues during OOBE.
• Intune Configuration: Device targeting must be correctly configured.

Step 1: Modifying the Autopilot Deployment Profile

Pre-provisioning is not enabled by default. You must explicitly allow it in your Autopilot Deployment Profile.

1. Navigate to the Microsoft Intune admin center (intune.microsoft.com).
2. Go to Devices > Windows > Windows enrollment.
3. Under Windows Autopilot Deployment Program, click Deployment Profiles.
4. Select your existing User-Driven profile (or create a new one) and click Properties.
5. Edit the Out-of-box experience (OOBE) settings.
6. Change the Allow pre-provisioned deployment toggle to Yes.
7. Ensure Join to Azure AD as is set to Azure AD joined. (Hybrid Azure AD Join is supported but immensely complex due to offline domain join requirements; cloud-native is highly recommended).
8. Save the profile.

Step 2: Structuring Application Assignments (Critical Step)

The most common reason Pre-Provisioning fails to save time is incorrect Intune application targeting.

During the Technician Flow, there is no user logged in. Therefore, Intune will only install applications assigned to Device Groups.

If you assign Adobe Acrobat to an “All Users” group, it will not install during the Technician Flow. The technician will seal the device, ship it to the user, and Adobe Acrobat will still download during the User Flow over their slow residential Wi-Fi, defeating the entire purpose.

The Fix:

1. Create an Entra ID Dynamic Device Group that captures all Autopilot devices (e.g., (device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))).
2. Assign your heavy, core applications (Office 365, VPN clients, EDR sensors, large Win32 apps) as Required to this Device Group.
3. Ensure these applications are set to install in the System context, not the User context.

Step 3: Configuring the Enrollment Status Page (ESP)

The Enrollment Status Page (ESP) tracks the installation progress and blocks the user from reaching the desktop until critical apps are installed.

For Pre-Provisioning, configure the ESP to block device use until the heavy apps are installed during the Technician Flow.

1. In the Intune console, go to Windows enrollment > Enrollment Status Page.
2. Edit your ESP profile.
3. Set Block device use until all apps and profiles are installed to Yes.
4. Under Block device use until these required apps are installed if they are assigned to the user/device, explicitly select your heavy core applications (e.g., your VPN and EDR).

Step 4: Executing the Technician Flow

With the backend configured, you can execute the provisioning:

1. Power on the factory-reset laptop.
2. When the first OOBE screen appears (language selection), press Windows Key + 5 rapidly.
3. The Windows Autopilot Provisioning screen will appear.
4. The screen will display the assigned Autopilot profile details. Click Provision.
5. The device will proceed through the Device ESP, downloading all device-assigned apps and policies.
6. When finished, a large green success screen appears. Click Reseal.

The device will cleanly shut down, ready to be boxed and shipped to the end-user.

Conclusion

Windows Autopilot Pre-Provisioning bridges the gap between modern cloud-native deployment and the reality of massive legacy Win32 applications. By shifting the deployment burden from the remote end-user’s residential network back to the corporate IT staging area (or the hardware OEM), organizations can guarantee that remote employees are productive within minutes of unboxing their new hardware.