INTUNE-014: Autopilot configuration
- Platform
- Entra ID / M365
- Category
- Intune / Endpoint Management
- Severity
- Info
- Zero Trust pillar
- Devices (weight 1)
- Golden fixtures
- 3
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
Windows Autopilot provides a zero-touch deployment experience that ensures new devices are configured with the correct security baselines from first boot. A poorly configured or missing Autopilot deployment profile means new devices may be provisioned without critical security settings, creating a window of vulnerability. Reviewing Autopilot configurations ensures consistent and secure device provisioning.
Recommended value
Autopilot deployment profile configured for all corporate devices with user-driven or self-deploying mode and Azure AD join
Remediation
Review existing Autopilot deployment profiles and verify they are configured for Azure AD join with appropriate user-driven or self-deploying mode settings. Ensure that the Enrollment Status Page is enabled to prevent users from accessing the desktop before all critical policies and applications are installed. Verify that all corporate device hardware hashes are registered with the Autopilot service and assigned to the appropriate deployment profile.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| clean | PASS |
| known-bad | WARN |
| throttled | Not Assessed |
Framework mappings
- NIST SP 800-53
- CM-2