Project 05: Zero-Touch Windows 11 Provisioning with Autopilot

The mission: a laptop ships from the distributor straight to the user’s door. They open it, sign in, get coffee, and come back to a compliant, encrypted, fully-provisioned machine. IT never touches the box.

#Provisioning Flow

 distributor ──▶ hardware hash ──▶ Autopilot registration
      │                                    │
      └── ships direct to user             ▼
                                    user powers on
                                           │
                              Entra join + MDM enroll
                                           │
                          ┌── ESP (Enrollment Status Page) ──┐
                          │ security baseline · BitLocker    │
                          │ compliance policy · core apps    │
                          └────────────────┬─────────────────┘
                                           ▼
                                   ✔ desktop unlocked

#Step 1 — Hardware Hash at the Source

The distributor registers devices before they ship — that’s the “zero” in zero-touch. For existing fleet, harvest hashes yourself:

1
2
3

Install-Script Get-WindowsAutopilotInfo -Force
# Direct-to-tenant upload; -GroupTag drives profile assignment
Get-WindowsAutopilotInfo -Online -GroupTag "STANDARD-USER"

Dynamic Entra groups pick devices up by tag:

(device.devicePhysicalIds -any (_ -eq "[OrderID]:STANDARD-USER"))

#Step 2 — The ESP Is the Contract

The Enrollment Status Page blocks the desktop until the machine is safe. Choose the blocking set ruthlessly:

• Block on: security baseline, BitLocker, compliance policy, the 4–5 apps everyone needs day one.
• Never block on: the 40-app “everything” list. Ship the rest in the background after the desktop unlocks.

#Step 3 — Compliance as Code, Not Memo

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

{
  "@odata.type": "#microsoft.graph.windows10CompliancePolicy",
  "displayName": "W11-BASELINE-PROD",
  "bitLockerEnabled": true,
  "secureBootEnabled": true,
  "defenderEnabled": true,
  "osMinimumVersion": "10.0.22631.0",
  "passwordRequired": true,
  "storageRequireEncryption": true
}

Non-compliant devices lose access via Conditional Access — the policy enforces itself. Pair it with a phased rollout:

1. Ring 0: IT’s own machines (1 week).
2. Ring 1: one friendly department (2 weeks, survey at the end).
3. Ring 2+: global waves by region, sized to the helpdesk’s capacity.

#Results