Autopilot: Device Names, ESP & Rollout

Device name templates

Template variables

Variable	What It Inserts	Example Result
%SERIAL%	Device serial number	TUI-5CG1234567
%RAND:X%	Random digits (X = number of digits)	TUI-PC-4829

Name length rules

• Windows computer names: maximum 15 characters (NetBIOS limit)
• Template must produce names within this limit
• Prefix + variable combined must not exceed 15 characters

Sam’s naming convention at Tui Solutions

Device Type	Template	Example	Why
Standard laptops	TUI-%RAND:5%	TUI-48291	Short, unique, easy to reference in tickets
Conference tablets	TUI-CR-%RAND:3%	TUI-CR-847	”CR” prefix identifies conference room devices
Warehouse kiosks	TUI-WH-%RAND:3%	TUI-WH-192	”WH” prefix identifies warehouse devices

💡 Exam tip: 15-character limit

The exam frequently tests the 15-character NetBIOS limit for computer names. If your template produces names longer than 15 characters, Autopilot will truncate them — which can cause duplicate names and confusion.

Example: TUISOLUTIONS-%RAND:5% = 18 characters → too long. The exam might present this as a scenario where devices have unexpected names after Autopilot deployment.

Keep prefixes short: 3-5 characters + separator + variable.

Implementing Autopilot deployment

Step 1: Register device hardware IDs

Before Autopilot can configure a device, its hardware identity must be registered:

1. OEM registration (recommended) — Dell, HP, Lenovo register hardware hashes when you order devices. They appear in Intune automatically.
2. Manual upload — export hardware hashes from existing devices using PowerShell: Get-WindowsAutopilotInfo -OutputFile devices.csv, then upload the CSV to Intune.
3. Partner registration — Microsoft partners can register devices on your behalf.

Where: Intune admin center → Devices → Enrollment → Windows enrollment → Devices

Step 2: Create an Autopilot deployment profile

Profile Setting	Options	Sam’s Choice
Deployment mode	User-driven / Self-deploying	User-driven (for laptops)
Join type	Entra Joined / Hybrid Joined	Entra Joined
OOBE settings	Hide/show privacy, EULA, account type screens	Hide all unnecessary screens
Device name template	Custom template	TUI-%RAND:5%
Allow pre-provisioned	Yes/No	Yes (for executive laptops)
Apply device name template	Yes/No + template string	Yes

Step 3: Assign the profile to a device group

Target the deployment profile to a dynamic device group containing Autopilot-registered devices:

Rule: (device.devicePhysicalIds -any (_ -startsWith "[ZTDID]"))

This ensures every device registered with Autopilot automatically receives the deployment profile.

Step 4: Assign apps and policies

Configure what gets installed during Autopilot:

• Required apps assigned to the device group deploy during Autopilot
• Configuration profiles apply during enrollment
• Compliance policies begin evaluating after enrollment

The Enrollment Status Page (ESP)

ESP phases

Phase	What Happens	Blocking?
Device preparation	Entra join, Intune enrollment, device identity setup	Always blocks
Device setup	Device-targeted apps install, config profiles apply, compliance evaluates	Configurable — can block for specific apps
Account setup	User-targeted apps install, user-specific policies apply	Configurable — can block for specific apps

ESP configuration

Where: Intune admin center → Devices → Enrollment → Windows enrollment → Enrollment Status Page

Setting	Options	Recommendation
Show app and profile configuration progress	Yes/No	Yes
Block device use until required apps are installed	Yes/No	Yes (for critical apps)
Block device use until all apps and profiles are installed	Yes/No	No (too slow — only block critical apps)
Show error when installation exceeds time limit	Yes/No + timeout	Yes, 60 minutes
Allow users to reset device if installation error occurs	Yes/No	Yes
Allow users to use device if installation error occurs	Yes/No	Context-dependent
Only show for devices provisioned by Autopilot	Yes/No	Typically Yes

💡 Exam tip: blocking apps vs all apps

The exam tests the difference between:

• Block until required apps installed — only apps explicitly marked as “required” in their assignment AND tagged as “blocking” in the ESP will hold up the process
• Block until ALL apps installed — every assigned app must complete before the user can proceed

Best practice: block only critical apps (Outlook, Teams, VPN client) — not everything. Blocking all apps makes Autopilot take 45+ minutes, which frustrates users and causes timeout failures.

To mark an app as blocking: assign it as “Required” to the device group, and in the ESP profile select “Block these apps until they are installed” with specific app IDs.

End-to-end Autopilot flow

Here’s what happens when Sam’s employee unboxes a new Tui Solutions laptop:

1. Power on → Windows OOBE starts
2. Connect to Wi-Fi → device contacts Autopilot service
3. Autopilot recognised → custom OOBE screens show Tui Solutions branding
4. User signs in → Entra join + Intune enrollment triggers
5. ESP appears → “Setting up your device for Tui Solutions…”
6. Device preparation → device identity configured
7. Device setup → company apps installing (Outlook, Teams, OneDrive)
8. Account setup → user-specific settings applying
9. ESP completes → user reaches the desktop with everything ready
10. Background sync → remaining non-critical apps install silently

Total time: approximately 15-30 minutes (varies by internet speed and app count).

🎬 Video walkthrough

Flashcards

Question

What is the maximum length for a Windows computer name?

Click or press Enter to reveal answer

Answer

15 characters (NetBIOS limit). Autopilot device name templates must produce names within this limit or they'll be truncated, potentially causing duplicates.

Click to flip back

Question

What are the three phases of the Enrollment Status Page?

Click or press Enter to reveal answer

Answer

1. Device preparation (Entra join, enrollment — always blocks). 2. Device setup (device-targeted apps and profiles — configurable blocking). 3. Account setup (user-targeted apps and policies — configurable blocking).

Click to flip back

Question

How do you register devices for Windows Autopilot?

Click or press Enter to reveal answer

Answer

Three ways: 1. OEM registration (Dell/HP/Lenovo register hardware hashes at purchase — recommended). 2. Manual CSV upload of hardware hashes to Intune. 3. Partner registration via Microsoft partners.

Click to flip back

Knowledge Check

Knowledge Check

Sam creates a device name template 'TUISOLUTIONS-%RAND:5%' for Autopilot. After deployment, devices have unexpected truncated names. What's the problem?

AThe template produces names longer than 15 characters, exceeding the NetBIOS limitBThe %RAND% variable doesn't work with AutopilotCDevice name templates can only use %SERIAL%, not %RAND%DSam forgot to enable device renaming in the deployment profile

Check Answer

Knowledge Check

Employees at Tui Solutions complain that after Autopilot deployment, they reach the desktop but Outlook and Teams aren't installed yet — they appear 10 minutes later. How should Sam fix this?

AReinstall Windows on the affected devicesBSwitch from user-driven to self-deploying modeCAssign Outlook and Teams as available apps instead of requiredDConfigure the Enrollment Status Page to block device use until Outlook and Teams are installed

Check Answer

---

Next up: Provisioning Packages & Windows 11 Upgrades — offline deployment and upgrading existing devices.