The Laptop Ships Straight to the New Hire: Building a Zero-Touch Autopilot Pipeline

Count the hours your team spent on the last laptop you shipped to a new hire: unbox, reimage, install apps, apply security settings, repack, ship. That workflow eats 2 to 5 hours per device, and it scales exactly as badly as it sounds.

Windows Autopilot deletes most of those hours. Devices ship from the OEM directly to the employee, and the out-of-box experience (OOBE) does the configuration: apps, security baselines, even security patches applied before the user ever reaches the desktop. No custom OS images, no USB sticks, no tech touching the machine.

By the end of this walkthrough you will see how Autopilot saves at least one hour per device, and usually far more.

What the manual workflow really costs#

Take a fictional company, Northwind Outdoors: fast-growing, two IT technicians, steady stream of new hires. Their current process per laptop:

1. Order laptops from Dell or HP.
2. Ship them to headquarters.
3. Unbox and reimage each device with a USB stick.
4. Manually install applications and security software.
5. Repackage and ship the device to the remote employee.

At 2 to 5 hours per device, multiplied across dozens of employees, those two techs are a bottleneck for the whole business.

What changes with Autopilot and Intune#

Same OEM, completely different flow:

• Instead of shipping to HQ, the OEM sends the device hardware IDs (hashes) directly to your Intune tenant.
• Intune becomes the single source of truth for apps, security baselines, and settings.
• The device ships straight to the end user, already associated with your organization.
• The user powers on, connects to Wi-Fi, and Autopilot provisions everything: Microsoft 365 Apps, OneDrive folder redirection, security baselines like Microsoft Defender Antivirus, custom branding, and lock screen settings.

From unboxing to a working desktop in 30 to 60 minutes, without IT touching the device.

The five pieces of an Autopilot rollout#

1. Prepare the environment#

In the Intune Admin Center, start by creating a group, for example Windows Autopilot Devices. This group is the container everything else assigns to: apps, security policies, and deployment profiles.

While you are at it, configure company branding (opens in new tab) so the OOBE greets new hires with your client's identity. A laptop that boots to "Welcome to Northwind Outdoors!" is a small touch that makes IT feel personal.

2. Register the devices#

Two routes into Autopilot:

• OEM integration with Dell, HP, or Microsoft Surface, where devices appear in your tenant automatically at purchase. Dell's setup is documented here: How to Connect Dell Management Portal to Microsoft Intune (opens in new tab).
• Manual upload using PowerShell during the OOBE to push the device hash to Intune:

Get-WindowsAutopilotInfo -Online

Microsoft documents the manual path here: Manually register devices with Windows Autopilot (opens in new tab), with the broader registration overview at learn.microsoft.com/en-us/autopilot/add-devices (opens in new tab).

Once a device is registered, assign it to a user or a dynamic group so policies and profiles apply automatically.

3. Create the deployment profile#

The deployment profile dictates what happens during OOBE. The settings that matter:

• User-driven or self-deploying mode
• Azure AD join or hybrid join
• Standard vs. admin account type. The default is standard, and that is the one you want.
• Whether to skip privacy and licensing screens
• Device naming conventions

This profile is what turns raw OEM hardware into a corporate-ready endpoint on first boot. Full setup instructions: Configure Windows Autopilot profiles (opens in new tab).

4. Assign policies and apps#

Intune delivers everything the device needs:

• Configuration profiles: Wi-Fi, lock screen timeout, OneDrive Known Folder Move
• Applications: Office, Chrome, Teams, line-of-business apps
• Security policies: Defender Antivirus, compliance baselines, Endpoint Protection

Assign all of it to your Autopilot device group and it flows down during enrollment. References: Configure device configuration profiles in Microsoft Intune (opens in new tab) and How to Deploy Microsoft 365 Apps With Intune (opens in new tab).

5. Configure the Enrollment Status Page#

The Enrollment Status Page (ESP) controls what users see while setup runs. You can require every app and policy to finish before login, or let users sign in early while installs continue in the background.

For sensitive environments, block device use until the security apps are fully installed. Nobody should start working on an unprotected machine. Full instructions: Set up the Enrollment Status Page (opens in new tab).

What the new hire actually sees#

1. Boot the device and connect to Wi-Fi.
2. A custom-branded login screen.
3. The Enrollment Status Page tracking apps and settings as they install.
4. A desktop with Office, Chrome, and OneDrive already configured the moment they get access.

Under an hour, zero IT intervention.

Why this is a posture upgrade, not just a time saver#

The hours back are the headline, but the quieter wins compound:

• Standardized configurations across the company, every time.
• No more reimaging or manual setup.
• Stronger security posture, because baselines apply consistently instead of depending on whoever built the machine.
• A better day-one experience for every employee.

For a company like Northwind Outdoors, or yours, that adds up to hundreds of hours a year and new hires who are productive before lunch.

Watch the full build#

We recorded the entire configuration end to end: watch the Windows Autopilot tutorial on YouTube (opens in new tab).