Runbook — Provision a New Windows Laptop with Intune

Assumes tenant prerequisites are in place: Intune is the MDM authority, Windows automatic enrollment (MDM user scope) is on, a Windows Autopilot deployment profile and Enrollment Status Page exist, and compliance/configuration policies and apps are assigned to a staff group. This runbook provisions one laptop for one new hire.

Phase A — Pre-provisioning (IT, before powering on the laptop)

A1. Create Sally's identity and license

1. M365 admin center → Users → Add a user:
   • Display name: Sally Wong
   • Username: swong@mptwork.com
   • Usage location, job title, department, manager.
2. Assign Microsoft 365 Business Premium (includes Intune, Defender for Business, Entra ID P1, Windows Update for Business). Confirm under Licenses.
3. Set a temporary password and require change at first sign-in.

A2. Add Sally to the right groups

1. Entra → Groups → add swong@mptwork.com to:
   • the licensing group (if using group-based licensing),
   • the Windows staff group that compliance policies, configuration profiles, and required apps are assigned to (e.g., Staff-Windows).
2. This drives policy/app targeting during provisioning — confirm before the device is turned on.

A3. Register the laptop in Windows Autopilot

1. Get the device's hardware hash:
   • New device: the OEM/reseller can register it to your tenant automatically, or supply a hardware-hash CSV.
   • Manual: run Get-WindowsAutopilotInfo on the device and export the CSV.
2. Intune → Devices → Enrollment → Windows → Windows Autopilot → Devices → Import the CSV (or confirm the OEM-registered device appears).
3. Confirm the device receives a user-driven, Microsoft Entra join Autopilot deployment profile (assign via its device group / group tag), and that the Enrollment Status Page (ESP) is configured.

Newer alternative: Windows Autopilot device preparation uses a device-preparation policy targeted to a security group and doesn't require pre-importing the hardware hash. Either path achieves a zero-touch, Entra-joined, Intune-enrolled laptop.

A4. Pre-flight checks

1. Compliance policy assigned to Staff-Windows (BitLocker, Secure Boot, minimum OS build, Defender healthy, firewall on).
2. Configuration profiles assigned: security baseline, BitLocker disk encryption (with recovery-key escrow to Entra), Windows Update rings, Wi-Fi/VPN, restrictions.
3. Required apps assigned: Microsoft 365 Apps, Microsoft Edge, Company Portal, Microsoft Defender.
4. Windows Hello for Business policy enabled (PIN/biometric).

Phase B — Provisioning at the device (Windows OOBE / Autopilot)

This can be done by IT first or handed to Sally. The laptop must reach the internet.

1. Power on the laptop; choose region and keyboard; connect to Wi-Fi (or Ethernet).
2. Autopilot recognizes the device and shows the MPT Work-branded company sign-in (OOBE is locked down per the profile).
3. Sally signs in with swong@mptwork.com and the temporary password, then completes MFA if prompted.
4. The laptop performs a Microsoft Entra join and auto-enrolls into Intune.
5. The Enrollment Status Page runs, applying device- and user-phase policies, certificates, and required apps before handing over the desktop.
6. Sally lands on the Windows desktop signed in with her account; she's prompted to set up Windows Hello (PIN/biometric).

Alternate (not Autopilot-registered): on the desktop go to Settings → Accounts → Access work or school → Connect → Join this device to Microsoft Entra, sign in as swong@mptwork.com (auto-enrolls). Then in Intune set the device Ownership = Corporate. This skips the branded OOBE experience.

Phase C — Automatic configuration and apps (verify, don't rush)

Allow several minutes and keep the laptop online.

1. Configuration profiles apply: security baseline, BitLocker (encryption begins; the recovery key escrows to Entra), Windows Update ring, Wi-Fi/VPN, restrictions.
2. Required apps install: Microsoft 365 Apps, Microsoft Edge, Microsoft Defender, Company Portal.
3. Defender for Business onboards the device.
4. Compliance policy evaluates (BitLocker on, Secure Boot, minimum build, Defender healthy, firewall on).

Phase D — Verify and enforce (IT)

1. Intune → Devices → Windows → open Sally's laptop:
   • Enrolled = yes, Ownership = Corporate, Primary user = Sally Wong (set under Properties if needed).
   • Compliance = Compliant (wait out any grace period; if non-compliant, open the policy to see which setting failed).
2. Confirm BitLocker is On and the recovery key is stored (device → Recovery keys, or in Entra under the device).
3. Confirm required apps installed (device → Managed Apps) and that Sally can install optional apps from Company Portal.
4. Confirm Defender shows the laptop onboarded (Defender portal → Devices).
5. Confirm Conditional Access: from this compliant laptop Sally can reach Microsoft 365; a non-compliant/unmanaged device is blocked.

Phase E — Hand off to Sally

Provide Sally with:

1. Sign-in: swong@mptwork.com + temporary password (change at first sign-in).
2. MFA enrollment: register at https://aka.ms/mfasetup (Microsoft Authenticator recommended).
3. Windows Hello: finish setting up a PIN/biometric for fast, secure sign-in.
4. Company Portal: where to install approved apps and check device status.
5. What's already set up: email/Teams/OneDrive, BitLocker encryption, security software.
6. IT support contact and the acceptable-use / device policy to acknowledge.

Sally's quick start:

• Sign in, set up Windows Hello, complete MFA registration, change the password.
• Open Outlook/Teams to confirm mail and chat.
• Open Company Portal to confirm the device is compliant and browse optional apps.

Phase F — Record and close out

1. Set/confirm Primary user = Sally Wong in Intune.
2. Update the asset register: serial number, model, assigned to Sally Wong, issue date, enrollment date.
3. Note the BitLocker recovery key location (Entra/Intune) for support.
4. Close the onboarding ticket.

Quick checklists

IT pre-provisioning

Post-enrollment verification

Notes

• Signing in as Sally during OOBE (user-driven Autopilot) is what binds the laptop to her and applies her user-targeted policies — don't pre-complete OOBE with a generic account.
• If the device isn't registered in Autopilot, you lose the branded zero-touch OOBE; use Entra join + auto-enrollment and set ownership to Corporate.
• BitLocker recovery keys escrow to Entra automatically with the disk-encryption policy — verify they're present before handing the device over.
• Verify current steps against Microsoft Learn — the Intune portal, Autopilot, and device-preparation flows change periodically.