Skip to main content

Glossary

Windows Autopilot

Windows Autopilot is Microsoft's provisioning service that turns a new PC into a configured, managed machine the first time it boots. The hardware identifier is registered with Microsoft beforehand, so the laptop recognizes its owner during setup and pulls its policies down on its own.

How it works

Everything starts with the hardware hash, a fingerprint unique to that machine. The OEM, the reseller or your own team uploads it to your tenant, so Microsoft's enrollment service knows the PC belongs to you before anybody opens the box. Autopilot has worked this way since Microsoft shipped it alongside Windows 10 in 2017, and it is the default deployment path on Windows 11 today.

The user powers on the laptop, picks a language, joins Wi-Fi and signs in with a work account. The out-of-box experience checks the hash against your registered list, applies the deployment profile you defined (skip the privacy prompts, rename the machine, block local admin rights), then hands the device over to management, which installs apps and security settings. Nobody reimages anything. The factory image stays.

Why it matters for a fleet

Imaging a PC by hand eats 40 to 90 minutes of technician time, plus a USB stick and a free desk. Autopilot moves that work into a profile you write once. Ship the sealed box to the employee's home and they can work the same morning.

It also settles the ownership question. A PC that was never enrolled is a PC nobody can patch, wipe or audit. Registering the hardware ID at purchase means enrollment happens whether or not the user cooperates, and a factory reset brings the machine back under management instead of setting it free.

The catch sits in the supply chain. Somebody has to register those hashes, so either your reseller plays along or a script collects them. Autopilot also assumes a decent connection during setup: on weak hotel Wi-Fi, the first boot can crawl.

How Appaloosa handles it

Appaloosa manages Windows PCs next to iPhones and Android devices in one console: enrollment, configuration policies, app deployment and enforced BitLocker encryption with key escrow. Where a fleet already registers its hardware with Microsoft, Autopilot takes care of the first boot and the machine is then enrolled in Appaloosa, which keeps laptops and phones under one set of rules instead of two tools and two teams. The supported enrollment modes and policies are listed on the Windows MDM page.

Explore

See the full platform

Enrollment, apps, security, remote support: all in one place.

Explore Appaloosa →

See Appaloosa run on your fleet Book a demo

Frequently asked questions

Do I need Microsoft Intune to use Windows Autopilot?
Autopilot itself is a registration and provisioning service tied to your Microsoft tenant, and Microsoft documents Intune as the management service it hands devices to. Other MDM platforms can manage the PC afterwards, so check what your vendor supports before you plan the rollout.
Where does the hardware hash come from?
Large orders usually arrive already registered by the OEM or reseller, which is the cleanest route. For machines you already own, a PowerShell script collects the hash from Windows and produces a CSV you upload yourself. Budget time for this on existing fleets.
Can a user skip Autopilot by reinstalling Windows?
No, and that is the point. The hardware ID stays registered on Microsoft's side, so a wiped or reinstalled PC meets the same enrollment step at the next out-of-box experience. Removing a device requires an administrator to deregister it.