Before Autopilot can provision a device, that device needs to be registered. Registration ties a specific piece of hardware to your tenant. Without it, the device powers on and goes through a standard Windows setup – Autopilot never triggers.
There are several ways to get devices registered. Which one you use depends on how you source hardware and how much control you have over the supply chain before devices reach users.
What a hardware hash is
The hardware hash is a unique identifier generated from the device’s hardware characteristics – a combination of the serial number, disk identifiers, network adapter MAC addresses, and other hardware-specific values. It’s collected by Windows during OOBE and uploaded to the Autopilot service to identify the device.
The hash is hardware-specific but not permanent in the way a serial number is. Replacing certain components – particularly the motherboard – can change the hash, which means a replaced motherboard effectively deregisters the device from Autopilot. In practice this is an edge case, but it’s worth knowing if your hardware refresh process involves component-level repairs.
Registration methods
OEM registration is the cleanest path. Most major PC manufacturers – Dell, HP, Lenovo, Microsoft Surface – can register devices directly into your Autopilot tenant at the point of manufacture or sale. You provide your tenant ID to the OEM or reseller, and devices arrive pre-registered. The device powers on, connects to the internet, finds its Autopilot registration, and begins the configured deployment flow without any pre-work from IT.
This is the model to aim for if you’re buying hardware through a business relationship with a participating OEM or reseller. It eliminates the hash collection step entirely and scales to any volume without additional effort. If your procurement process doesn’t currently support this, it’s worth establishing – the operational benefit is significant.
CSV upload is the manual registration path. You collect hardware hashes from devices, compile them into a CSV file, and upload the file to Intune. The CSV format requires four columns: Device Serial Number, Windows Product ID, Hardware Hash, and optionally a Group Tag. The Group Tag is useful for automatically assigning devices to the correct Autopilot device group at registration – devices with a specific tag land in the group that matches it, which means the right Autopilot profile applies without manual group assignment.
Reseller registration sits between OEM and manual. Some resellers – particularly Microsoft Cloud Solution Providers – can register devices into your tenant on your behalf using the Partner Center. You provide authorization, they handle the registration. This works well when you’re buying through a CSP that has set up the integration, and it gives you OEM-style registration without requiring a direct relationship with the manufacturer.
Collecting hashes manually with Get-WindowsAutoPilotInfo
When OEM or reseller registration isn’t available, Get-WindowsAutoPilotInfo is the standard tool for hash collection. Install it from the PowerShell Gallery and run it on each device. There are three patterns worth knowing.
The first uploads directly to Intune during OOBE without producing a CSV file at all:
Get-WindowsAutoPilotInfo -Online -GroupTag "StandardLaptop"The -Online switch authenticates to Intune and uploads the hash immediately. The device appears in the Autopilot device list within minutes. This requires credentials with Intune admin rights – during OOBE that means signing in as a global admin or a dedicated enrollment account. Include -GroupTag here if you’re using tags to drive profile assignment.
The second collects to a CSV for batch upload later:
Get-WindowsAutoPilotInfo -OutputFile C:\hash.csvThe third appends to an existing CSV – useful when you’re collecting hashes from multiple devices and want a single file to upload:
Get-WindowsAutoPilotInfo -OutputFile C:\hashes.csv -AppendRun this on each device in sequence, appending to the same file. Once collection is complete, upload the single CSV to Intune via Devices → Windows → Windows Enrollment → Devices → Import. The batch approach is faster than uploading individual files when you’re registering more than a handful of devices at once.
CSV upload works, but it doesn’t scale. If you’re registering more than a handful of devices at a time, OEM registration or a reseller relationship is worth the setup effort.
Converting existing Intune devices to Autopilot
If you have devices already enrolled in Intune that were never registered through Autopilot, there’s a registration path that doesn’t require touching the device at all. The Autopilot deployment profile has a setting called “Convert all targeted devices to Autopilot.” When enabled, any corporate-owned Intune-managed device assigned to that profile is automatically registered into Autopilot on its next check-in. This works for both Entra ID joined and hybrid Entra ID joined devices – if the device is enrolled in Intune and marked corporate-owned, the setting will register it.
This is useful when you’re adopting Autopilot mid-lifecycle – devices that were enrolled manually or through bulk enrollment can be brought into the Autopilot device list without re-enrollment or manual hash collection. The registration happens in the background during a normal device sync cycle. Allow up to 48 hours for processing, though most devices complete within a few hours.
One important distinction for hybrid joined devices: the setting registers the device in the Autopilot service – it does not convert the device from hybrid join to Entra join. The device remains hybrid joined. What changes is that on its next reset or wipe, it will go through the Autopilot provisioning flow rather than a standard Windows setup.
There’s a known issue specific to hybrid joined devices worth being aware of. When Autopilot registers a hybrid device through this method, it sometimes creates a new Entra ID object tied to the Autopilot registration rather than linking to the existing hybrid device object. If you’re using Group Tags and dynamic groups to drive profile assignment, the Group Tag may not resolve correctly against the hybrid device object, breaking dynamic group membership. Test this with a pilot device before rolling it out to a hybrid fleet.
Once registered, the device is in the Autopilot service permanently from the tenant’s perspective. Removing it requires deliberately deleting it from the Autopilot device list – a manual step that’s easy to overlook during device offboarding. Build that into your offboarding process before it becomes a gap.
Group Tags
Group Tags deserve specific attention because they’re underused and genuinely useful. A Group Tag is a string value assigned to a device at registration. Entra ID dynamic device groups can target Group Tags, which means you can build a group rule like device.devicePhysicalIds -any (_ -contains "[OrderID]:StandardLaptop") and any device registered with that tag automatically lands in the group – and therefore receives the Autopilot profile assigned to that group.
This matters when you have multiple device types with different Autopilot profiles. Standard user laptops get one profile. Executive devices get another. Shared devices get a third. Rather than manually assigning each device to the correct group after registration, you tag them correctly at registration time and the group membership resolves automatically.
OEM and reseller registrations can include Group Tags if you provide them at the time of order. CSV uploads include the Group Tag as a column. The -GroupTag parameter in Get-WindowsAutoPilotInfo sets it during direct upload. It takes almost no additional effort to implement and eliminates a class of manual work that compounds at scale.
Verifying registration
After registration – through any method – verify that devices appear in the Autopilot device list in Intune before they ship to users. Registration processing is not instant. OEM registrations can take 24 to 48 hours to propagate. CSV uploads are faster but still not immediate. A device that ships before its registration has processed will go through standard Windows setup rather than Autopilot.
The Autopilot device list in Intune shows each registered device, its assigned profile, and its Group Tag. Check that the profile assignment is correct – particularly if you’re using Group Tags to drive profile assignment – before devices leave your hands. Fixing a profile assignment after a device has already been provisioned requires a reset and re-enrollment.
Intune Deployment Guide · Phase 4: Provisioning
‹ Previous: [4.1.2] Enrollment Status Page: Designing for Reliability
Next: [4.2] Provisioning without Autopilot ›
