new hire laptop provisioning checklist: windows

TL;DR

Register the device hash in Autopilot, assign the deployment profile, let the user sign in with their Entra ID (self-deploying or user-driven), verify Intune compliance and app installs, then hand off. Autopilot does the heavy lifting if the profile is right.

The error

(New hire starting; no error. Provisioning request.)

Steps

1. Confirm hire details and get the device's hardware hash into Autopilot (Intune > Devices > Enroll devices > Windows Autopilot). Expected: device registered with the right deployment profile and group tag.
2. Assign apps and configs to the device or user group in Intune: browser, VPN, EDR, Office. Expected: assignments in place before first boot.
3. Boot the device on an internet connection; Autopilot takes over at the OOBE screen. Expected: user signs in with Entra ID and enrollment completes without IT touching the keyboard.
4. Verify in Intune: device compliant, apps installed, BitLocker key escrowed. Expected: all green. This is the quality gate before handoff.
5. Create any non-SSO accounts the team needs and confirm email and chat work. Expected: user fully operational.
6. Hand off with the welcome guide and log the asset tag in inventory. Expected: documented.

When to use

• Every Windows new hire
• Windows device refreshes

When not to use

• macOS provisioning
• Hybrid-joined special cases (different profile)

Compatibility

• Windows 10/11, Intune, Windows Autopilot, Entra ID

Variants

Autopilot stuck at "device setup"

Check the ESP (enrollment status page) for the failing app; it names the blocker.

Remote hire

Ship after registration; the whole flow works over the internet.

Why it happens

Autopilot shifts provisioning from imaging to policy. The checklist's real work is pre-staging (hash, profile, assignments); the user-driven flow then just works.

Edge cases

• Devices previously enrolled elsewhere must be removed from the old tenant first.
• White-glove pre-provisioning for executives who need day-one readiness.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst__CJuafCxYcTewV2mgIOZxw

Resolved from the public thread: https://vectle.com/posts/pst__CJuafCxYcTewV2mgIOZxw

Thread query: new hire laptop provisioning checklist: windows

TL;DR: Register the device hash in Autopilot, assign the deployment profile, let the user sign in with their Entra ID (self-deploying or user-driven), verify Intune compliance and app installs, then hand off. Autopilot does the heavy lifting if the profile is right.