Windows Autopilot for Pre-provisioned deployment (White Glove)

Platforms

Windows

Products

IntuneWindows AutopilotEntra ID

Result

Users unbox a device that already has its apps and policies, and only the account setup runs at first sign-in

Overview

Let a technician install the apps and policies before the device reaches the user: turn on Autopilot pre-provisioning, run the technician flow, reseal and ship.

Windows Autopilot pre-provisioning (formerly White Glove) moves the slow part of Autopilot, installing apps, policies and profiles, from the user to a technician: IT, a partner or the OEM.

Users then get a business-ready device straight from the out-of-box experience (OOBE), without the wait you often see when a new device is set up. For details, see Windows Autopilot for pre-provisioned deployment.

In this post I turn on pre-provisioning in an existing user-driven Autopilot profile and show both workflows, the technician flow and the user flow.

Prerequisites

Before you start, check that you have the following.

Configuration

Turn on pre-provisioning in the Autopilot profile.

Allow pre-provisioning in the Autopilot profile

I have an existing user-driven Microsoft Entra join Autopilot profile. In the Intune admin center, I edit it under Devices > Windows > Windows enrollment > Windows Autopilot deployment profiles:

To turn on pre-provisioning, set this in the profile (in 2020 it was Allow White Glove OOBE):

• Allow pre-provisioned deployment: Yes

Note: if this setting is No, a technician can still press the Windows key five times, but Intune blocks it and pre-provisioning fails with error 0x80180005 (see Configure Windows Autopilot profiles).

Pre-provisioning and user experience

Run the technician flow first, then the user flow.

Pre-provisioning has two phases:

• Phase 1: Technician flow, done by IT, a partner or the OEM
• Phase 2: User flow, done by the user who receives the device

My test device is a Microsoft Surface Book with Windows 10 20H2. The Surface Book has no Ethernet (RJ45) port, so I also show how to use Wi-Fi during pre-provisioning.

Phase 1: technician flow

When the device starts and stops at the first OOBE screen, don't select Next. Press the Windows key five times until the What would you like to do? screen appears, then select Windows Autopilot provisioning:

This is what happens (red screen) when there's no Ethernet connection:

Press Shift+F10 to open a command prompt and run this command (see Michael Niehaus's post on Wi-Fi with White Glove):

start ms-availablenetworks:

It opens the list of wireless networks, so you can connect to Wi-Fi instead of Ethernet:

Update (October 2026): Microsoft now documents Wi-Fi for pre-provisioning: select the region, language and keyboard first, then connect to Wi-Fi before you start provisioning (see Windows Autopilot for pre-provisioned deployment).

Once connected to Wi-Fi, select Retry. This time a blue screen appears with the option to Provision the device:

Autopilot provisioning (Setting up your device for work) has three stages:

• Device preparation: joins Microsoft Entra ID (or Active Directory with Microsoft Entra hybrid join) and enrolls the device in Intune
• Device setup: installs all device-targeted policies, certificates, apps and settings
• Account setup: optional; installs user-targeted apps that run in device context (Win32 or LOB), if they're assigned to the user

Pre-provisioning succeeded when the green screen appears, with the Autopilot profile, the organization name, the assigned user and a QR code.

Select Reseal to shut down the device:

The device can now be shipped to the user, with the apps, updates, policies and profiles already applied.

Phase 2: user flow

The user goes through the standard Autopilot OOBE set in the deployment profile.

First they see the welcome screen of their organization (when connected to Ethernet) and sign in with their email and password (Microsoft Entra ID credentials):

After sign-in, the Setting up your device for work screen appears. The first two stages, Device preparation and Device setup, already have a green check mark because the technician completed them in phase 1:

So Autopilot starts at the last stage, Account setup, which delivers the remaining user-targeted policies, profiles and apps (user context only).

When that stage ends, the device is ready for work.