How to Build a Windows 11 Intune & Autopilot Test Lab (Physical & Virtual Setup Guide)

Deploying new Intune configuration profiles, compliance baselines, or Autopilot deployment profiles directly into production risks user lockouts, unexpected reboots, and broken application deliveries. A controlled test lab allows endpoint engineers and systems administrators to safely reproduce real-world enterprise scenarios before rolling them out fleet-wide.

Whether you have spare physical hardware or prefer the speed of local virtualization, this guide walks you through the entire Windows Autopilot process from scratch, starting with tenant preparation through the final OOBE user experience.

What Is Windows Autopilot?

Windows Autopilot is a cloud-based deployment technology built into Microsoft Intune that allows IT administrators to configure new Windows devices into a business-ready state without ever touching a traditional OS image. Instead of building and maintaining custom Windows images with SCCM/MECM task sequences, you register the device’s unique hardware identity (called a hardware hash) with the Autopilot service. When the end user powers on the device for the first time, Windows automatically downloads the organization’s policies, apps, and security configurations during the Out-of-Box Experience (OOBE).

Autopilot supports several deployment scenarios:

Autopilot supports three primary deployment methods depending on how the endpoint will be used:

• User-driven mode joins the computer to Microsoft Entra ID when the assigned employee signs in during OOBE. This is the primary scenario covered in this guide.
• Self-deploying mode provisions shared workstations, digital signage, or kiosk systems without prompting for user credentials.
• Pre-provisioning (formerly White Glove) allows technicians or hardware vendors to pre-load large enterprise applications and device policies before delivery to the employee.

When a user receives a new device directly from an OEM such as Dell, HP, or Lenovo, they connect to Wi-Fi and sign in with their corporate account. Windows then provisions required security baselines, certificates, and applications automatically with no manual staging needed from IT technicians.

Prerequisites & Licensing

Before you begin, verify that your Microsoft 365 tenant meets these requirements:

• Licensing: Microsoft Intune Plan 1 (included in Microsoft 365 E3/E5, EMS E3/E5, or Business Premium). Windows Autopilot requires either Windows 11 Pro or Enterprise.
• Entra ID: Microsoft Entra ID P1 or P2 (included in EMS E3/E5) for dynamic group membership and conditional access policies.
• Network: Outbound HTTPS (443) access to Microsoft endpoints including login.microsoftonline.com, enterpriseregistration.windows.net, and ztd.dds.microsoft.com.
• MDM Authority: Microsoft Intune must be set as the MDM authority in your tenant (this is the default for new tenants).
• Hardware: Physical devices or virtual machines with TPM 2.0 and UEFI Secure Boot enabled. For Hyper-V VMs, Generation 2 is required.

Physical vs. Virtual Test Endpoints: Choosing the Right Approach

Enterprise administrators often debate whether an Intune lab should run on physical computers or inside virtual machines. In practice, mature engineering teams utilize both approaches depending on the specific workload under test:

The Three Core Test Client Scenarios

To comprehensively validate Microsoft Intune and Entra ID policies, your lab environment should maintain three distinct test machines:

1. Client 1: BYOD / Workplace Join (Microsoft Entra Registered)

   Simulates a contractor or employee using a personal laptop. The device connects to corporate resources via Settings > Accounts > Access work or school. It validates Mobile Application Management (MAM) policies, app protection, and personal device restrictions without giving IT full administrative control over the underlying operating system.

2. Client 2: Direct Corporate Cloud Join (Microsoft Entra Joined)

   Simulates a standard company-owned device joined directly to cloud identity during Windows Setup (OOBE). This client validates Device Configuration profiles, Settings Catalog rules, BitLocker disk encryption, and local administrator group management.

3. Client 3: Windows Autopilot Provisioning

   A fresh, unconfigured machine whose hardware hash is pre-imported into your Intune tenant. This client is used to test the Out-of-Box Experience (OOBE), Enrollment Status Page (ESP) blocking, application pre-installation, and Autopilot Reset workflows.

Step 1: Setting Up Your Test Endpoints

Option A: Using Physical Hardware

If you are using spare laptops or desktops:

• Ensure the system supports UEFI and TPM 2.0 (verify that TPM is enabled in the BIOS/firmware settings).
• Create a bootable Windows 11 installation USB flash drive using the Microsoft Media Creation Tool or Rufus.
• Boot the machine from the USB drive, wipe all existing partitions, and allow setup to copy files.
• When the machine restarts and displays the first Out-of-Box Experience screen (“Is this the right country or region?”), leave the machine at that prompt.

Option B: Using Hyper-V Virtualization

If you prefer running test machines locally on a Windows 11 host, use PowerShell to provision Generation 2 virtual machines equipped with Virtual TPM and Secure Boot:

# Define Lab Parameters
$VMPath = "C:HyperVIntuneLab"
$SwitchName = "Default Switch"
$VMList = @("Client1_BYOD", "Client2_AADJ", "Client3_Autopilot")

# Ensure target directory exists
if (-not (Test-Path $VMPath)) {
    New-Item -Path $VMPath -ItemType Directory -Force | Out-Null
}

foreach ($vm in $VMList) {
    Write-Host "Creating Generation 2 VM: $vm..." -ForegroundColor Cyan
    $vhdPath = Join-Path -Path $VMPath -ChildPath "$vm$vm.vhdx"
    
    # Create VM with 4GB startup RAM and 64GB virtual disk
    New-VM -Name $vm -Generation 2 -MemoryStartupBytes 4GB -SwitchName $SwitchName -NewVHDPath $vhdPath -NewVHDSizeBytes 64GB
    
    # Configure CPU and disable Dynamic Memory for consistent enrollment testing
    Set-VMProcessor -VMName $vm -Count 2
    Set-VMMemory -VMName $vm -DynamicMemoryEnabled $false
    
    # Enable Virtual TPM and Secure Boot (Mandatory for Windows 11)
    Set-VMSecurity -VMName $vm -TPMEnabled $true
    Set-VMFirmware -VMName $vm -EnableSecureBoot On -SecureBootTemplate "MicrosoftWindows"
}
Write-Host "All Lab VMs successfully created with TPM 2.0 and Secure Boot." -ForegroundColor Green

Step 2: Establishing a Clean Baseline for Repeated Testing

Testing Autopilot or enrollment policies requires the ability to reset an endpoint back to its initial state quickly.

• For Virtual Machines: Boot your VM with the Windows 11 ISO attached. Proceed through initial file extraction until the first OOBE setup screen appears. Turn off the VM and take a Hyper-V Checkpoint named Base_OOBE. Whenever a test completes, applying this checkpoint restores the machine to a pristine state in seconds.
• For Physical Devices: Keep an automated Windows 11 USB installer ready, or use the built-in Windows Recovery environment (Settings > System > Recovery > Reset this PC) with the “Cloud download” and “Clean the drive” options.

Step 3: Preparing the Tenant & Group-Based Licensing

Your test tenant requires licenses that include Microsoft Entra ID P1 or P2 and Microsoft Intune. In enterprise environments, this is typically provided via Microsoft 365 E5, Microsoft 365 E3, or Enterprise Mobility + Security (EMS) E5.

1. Sign in to the Microsoft 365 admin center.
2. Navigate to Billing > Your products and confirm that your subscription includes Intune Plan 1 and Entra ID P1/P2 licenses.

Rather than assigning licenses manually per user, we will use Entra ID group-based licensing. This ensures any test user added to the group automatically inherits Intune and OS upgrade rights.

3. Open the Microsoft Entra admin center and go to Groups > All groups > New group.
4. Create a security group named GL-IntuneLicense with Assigned membership.

5. Under the new group's settings, navigate to Licenses > Assignments. Select your Microsoft 365 E5 or EMS E5 and Windows Enterprise licenses, ensuring Intune is enabled, and save the assignment.

6. Navigate to the Members tab of the GL-IntuneLicense group and add your test accounts (for example, Admin-Test or AdeleV). Every test account added will be licensed automatically.

Step 4: Enabling Automatic MDM Enrollment

Windows endpoints cannot register into Intune during sign-in unless Automatic Enrollment is explicitly enabled:

1. In the Microsoft Intune admin center, navigate to Devices > Windows > Windows enrollment > Automatic Enrollment.
2. Set the MDM user scope to All (or choose Some and target your GL-IntuneLicense group).
3. Set the MAM user scope to None. Leaving MAM enabled on corporate Windows devices can cause enrollment handoff conflicts.
4. Click Save.

Step 5: Configuring Company Branding & Company Portal

Configuring company branding provides visual proof to administrators and test users that the endpoint is successfully communicating with your specific tenant during setup.

1. In Microsoft Entra ID, navigate to Identity > User experiences > Company branding.
2. Edit the default branding to upload your organization square logo (240×240 PNG) and sign-in background image (1920×1080 JPG under 300 KB). This controls the Out-of-Box Experience (OOBE) and web login screens.

Next, configure the internal branding for the Intune Company Portal application:

3. In the Intune admin center, go to Tenant administration > Customization.
4. Under Default Policy, edit the configuration to enter your company name, support email, phone number, and primary theme color.

Step 6: Verifying the First Lab Enrollment (BYOD Test)

To verify that tenant enrollment, discovery endpoints, and licenses are functioning properly before testing Autopilot, perform a Bring Your Own Device (BYOD) registration on Client 1. This confirms that modern workplace registration works smoothly from the user side.

1. Start Client 1 and sign in with a local administrator account.
2. Open Settings > Accounts > Access work or school.

3. Click Connect to launch the Microsoft account setup wizard.
4. Enter the credentials of your test user who belongs to the licensed group (e.g., adelev@yourtenant.onmicrosoft.com).

5. Verify that your custom company branding (configured in Step 5) appears on the login screen. Enter the password and complete authentication.

6. Once registration finishes, the wizard confirms with “You’re all set!”. Click Done.

7. Open the Microsoft Entra admin center under Devices > All devices. You will see the device listed with a Join Type of Microsoft Entra registered (Azure AD registered).

8. Check the Microsoft Intune admin center under Devices > All devices. The device shows an Ownership of Personal and Managed by set to Intune.

Step 7: Corporate Join & Windows 11 Enterprise Step-Up

In Step 6, you enrolled Client 1 as a personal (BYOD) device. Next, you will test Client 2 as a corporate-owned Entra ID-joined endpoint. This test validates full cloud-native management and verifies Windows 11 Enterprise dynamic subscription activation.

The key differences between BYOD and Corporate enrollments in Intune:

• BYOD (Personal): Enrolled from Windows Settings on an existing desktop session. Intune limits remote actions to Selective Wipe (retiring company data only) to protect user personal files.
• Corporate (Company-Owned): Joined to Entra ID during initial OOBE setup. Intune has full management authority, including complete device wipe, BitLocker recovery key escrow, and silent app pushes.

How to Enroll Client 2 as Corporate via OOBE

1. Start Client 2 from your clean baseline.
2. During the initial Windows Out-of-Box Experience (OOBE), select “Set up for work or school”.
3. Sign in with your organizational test user credentials.

4. Enter your user password on the branded sign-in screen. Accept the privacy settings to proceed to the desktop.

5. In the Microsoft Entra admin center, open Devices > All devices. Client 2 shows a Join Type of Microsoft Entra joined (Azure AD joined).

6. In the Intune admin center, navigate to Devices > All devices. Client 2 is classified with an Ownership of Corporate.

Verifying Dynamic Edition Step-Up to Windows 11 Enterprise

Because your user account has a Windows 10/11 Enterprise E3/E5 license assigned via the GL-IntuneLicense group, Windows detects this cloud entitlement upon login and dynamically upgrades from Windows 11 Pro to Windows 11 Enterprise without requiring a reboot, reimaging, or entering a product key.

To verify the step-up on Client 2, press Win + R, type winver, and press Enter:

Step 8: Harvesting the Hardware Hash

For a device to be provisioned via Windows Autopilot, Microsoft Intune must recognize its unique hardware identity. In a production environment, your OEM or reseller typically uploads these hashes for you. For our lab, we must manually harvest the hash from Client 3 (Autopilot Test).

1. Start the Client 3 virtual machine. Wait until you reach the first Windows Out-Of-Box Experience (OOBE) screen (usually the region selection screen).
2. Press Shift + F10 to open a command prompt.
3. Execute the following PowerShell commands to install the necessary script and export the hash to a CSV file:

PowerShell.exe -ExecutionPolicy Bypass
Install-Script -Name Get-WindowsAutopilotInfo -Force
Get-WindowsAutopilotInfo.ps1 -OutputFile C:HWID.csv

Once the HWID.csv file is generated, you can copy it to a USB drive or mount a virtual disk to transfer it to your host machine.

Step 9: Importing the Device into Intune

With the CSV file securely on your host machine, you must upload it to Microsoft Intune so the device becomes an official Autopilot-registered device.

1. Open the Microsoft Intune admin center.
2. Navigate to Devices > Windows > Windows enrollment > Devices.
3. Click Import and select your HWID.csv file.
4. The import process may take 10-15 minutes. Once completed, your device will appear in the Autopilot devices list with its serial number.

Step 10: Creating a Dynamic Device Group

To automate assigning the Autopilot profile and apps, you should create a dynamic Entra ID security group that automatically catches all registered Autopilot devices.

1. In the Microsoft Entra admin center, navigate to Groups > All groups > New group.
2. Name it Autopilot-Devices and set the Membership type to Dynamic Device.

3. Click Add dynamic query and configure the rule syntax: (device.devicePhysicalIDs -any (_ -contains "[ZTDId]"))

Step 11: Creating the Autopilot Deployment Profile

The Deployment Profile defines the exact OOBE experience your users will see.

1. In the Intune admin center, go to Devices > Windows > Windows enrollment > Deployment Profiles.
2. Click Create profile > Windows PC.
3. Name the profile (e.g., Lab-User-Driven-Profile).

4. Set the deployment mode to User-Driven and join to Entra ID as Microsoft Entra joined. Hide the EULA and privacy settings.

5. On the assignments tab, assign this profile to your dynamic Autopilot-Devices group.

Step 12: Configuring the Enrollment Status Page (ESP)

The Enrollment Status Page ensures that the device is fully secure and configured before the user is allowed to access the desktop. It tracks device setup, app installations, and policy application.

1. In the Intune admin center, go to Devices > Windows > Windows enrollment > Enrollment Status Page.
2. Create a new profile or edit the default profile.
3. Set Show app and profile configuration progress to Yes.
4. Set Block device use until all apps and profiles are installed to Yes.
5. Assign the ESP to the Autopilot-Devices dynamic group.

Step 13: Testing the Autopilot OOBE Experience

With the hash imported, the profile assigned, and the ESP configured, it is time to test the fully automated Autopilot workflow on Client 3.

1. Reboot Client 3 or resume the VM. Because you already ran the PowerShell script, simply restart the machine from the OOBE screen (shutdown /r /t 0).
2. Once the VM restarts, it will automatically connect to the internet, reach out to the Autopilot service, and recognize its hardware hash.
3. The standard Windows setup screens will skip, and you will be immediately presented with your custom Company Branding login page.

4. Sign in with your licensed Entra test user (e.g., Admin-Test or someone@example.com).
5. The Enrollment Status Page (ESP) will take over, showing the progress of Device preparation, Device setup, and Account setup.

6. Pro Tip: If the deployment seems stuck or you want to verify the exact phase, you can press CTRL + SHIFT + D to open the hidden Windows Autopilot Diagnostics Screen!

7. Once complete, you will be prompted to set up a PIN (Windows Hello for Business) or taken directly to the Windows 11 Enterprise desktop.

Conclusion

You have successfully built an enterprise-grade Windows Autopilot and Intune test lab from scratch! By establishing clean VM baselines, strictly defining MDM scopes, utilizing group-based licensing, and executing the full Autopilot deployment pipeline, you can now safely test Win32 app deployments, PowerShell remediation scripts, and complex security policies in an environment that perfectly mirrors production.