Windows Autopilot - known issues

Article
12/09/2024
Applies to:

✅ Windows 11, ✅ Windows 10

This article describes known issues that can often be resolved with configuration changes or via cumulative updates. Some known issues might also be resolved automatically in a future release.

Tip

RSS can be used to notify when new known issues are added to this page. For example, the following RSS link includes this article:

https://learn.microsoft.com/api/search/rss?search=%22Be+informed+about+known+issues+that+might+occur+during+Windows+Autopilot+deployment.%22&locale=en-us&%24filter=

This example includes the &locale=en-us variable. The locale variable is required, but it can be changed to another supported locale. For example, &locale=es-es.

For more information on using RSS for notifications, see How to use the docs in the Intune documentation.

Note

For issues with Autopilot with Co-management, see Windows Autopilot with co-management.

Known issues

Local Administrator Password Solution (LAPS) policy isn't being applied during the Technician Flow

Date added: December 9, 2024

During Windows Autopilot pre-provisioning technical flow, if a LAPS policy is targeted to the device or user, it isn't applied until the user phase begins.

Windows Autopilot deployment report and AutopilotEvents Graph API only returns 50 records at a time

Date added: December 4, 2024

In Intune's 2411 release, we've updated the backend infrastructure of the Windows Autopilot deployment report for consistency with other Intune reports. With this change, the Windows Autopilot deployment report and the AutopilotEvents Microsoft Graph API now return 50 records at a time. To show more than 50 records at a time:

Use the skipToken parameter to get additional pages of data with the AutopilotEvents Graph API.
Use the export API with reportName AutopilotV1DeploymentStatus to get all records.

DFCI enrollment fails for Professional editions of Windows 11, version 24H2

Date added: October 9, 2024

DFCI can't currently be used on devices with Professional editions of Windows 11, version 24H2. The issue is being investigated. As a workaround, ensure the device is upgraded to the Enterprise edition of Windows 11, version 24H2 during or after OOBE onboarding. After upgrading to the Enterprise edition of Windows 11, version 24H2, sync the device. Once the device is synced, reboot it to get it enrolled in DFCI.

Autopilot deployment report doesn't support sorting

Date added: August 29, 2024

The Autopilot deployment report was updated to a new infrastructure that doesn't currently support column sorting. The issue will be addressed in the future.

Auto logon for Kiosk device profile only partially fixed

Date added: August 21, 2024

The know issue of Kiosk device profiles not auto logging in when auto logon was enabled was previously reported as fixed. However, there are scenarios where the issue might still occur when using autologon with Kiosks and Assigned Access. If multiple reboots or unexpected reboots occur during the Windows out-of-box experience (OOBE) when initially configuring the Kiosk, the autologon entries in the registry might be deleted. The issue is being investigated.

The following workarounds are available until the issue is resolved:

Apply or reapply the kiosk profile after Windows Autopilot completes.

Apply the autologon registry entries either manually or via a script. For example:

reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AutoAdminLogon" /t REG_DWORD /d 1 /f

reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultDomainName" /t REG_SZ /d "." /f

reg.exe add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /t REG_SZ /d "kioskUser0" /f

Exclude items the required reboots during OOBE from Windows Autopilot.
Manually enter the kiosk user credentials.

For more information, see Assigned Access recommendations - Automatic sign-in. For additional assistance, contact support.

BitLocker encryption defaults to 128-bit when 256-bit encryption is configured

Date added: July 8, 2024

In some Windows Autopilot deployments of unregistered devices, BitLocker encryption might default to 128-bit even though the admin configured 256-bit encryption due to a known race condition. The issue is being investigated. Microsoft recommends that customers who need 256-bit BitLocker encryption register devices for Autopilot.

Required apps aren't shown on the Enrollment Status Page (ESP) after an Autopilot Reset

Date added: May 17, 2024

When an Autopilot Reset happens, the required apps aren't installed on the Enrollment Status Page (ESP) before the user reaches the desktop. The apps aren't tracked on the ESP, but the apps are installed when the user signs in to the desktop.

Enrolled date for Autopilot device is incorrect

Date added: November 1, 2023

The Enrolled date in the Devices | All devices and Windows | Windows devices panes display the date the device was registered to Autopilot instead of the date it was enrolled to Autopilot. For a more accurate date for when the device enrolled to the tenant:

Use the Intune Graph API to query the device:

devices?$filter=physicalIds/any(p: startswith(p, '[ZTDID]'))&$select=id,deviceId,displayName,physicalIds,createdDateTime

For more information, see Intune devices and apps API overview and Working with Intune in Microsoft Graph.
Use the Windows Autopilot deployment report for recently deployed devices.

Filtering Windows Autopilot devices not working as expected

Date added: July 14, 2023

Viewing Windows Autopilot devices within Intune might not work as expected if attempting to filter results. While this issue is being worked on, a workaround is to use Microsoft Graph API to properly query and filter necessary devices.

TPM attestation isn't working on some platforms with Infineon SLB9672 discrete TPMs

Date added: June 2, 2023

Platforms with the Infineon SLB9672 TPM with firmware release 15.22 with EK certificate might fail with error message Something happened, and TPM attestation timed out. To resolve this issue, contact the OEM for an update.

Kiosk device profile not auto logging in

Date added: January 30, 2023
Date updated: August 21, 2024

There's currently a known issue in the following Windows Updates released in January 2023:

Windows 11, version 22H2: KB5022303
Windows 11, version 21H2: KB5022287
Windows 10, version 22H2: KB5022282

If these updates are installed on a device, Kiosk device profiles that have auto logon enabled won't auto log on. After Autopilot completes provisioning, the device stays on the sign-in screen prompting for credentials. To work around this known issue, manually enter the kiosk user credentials with the username kioskUser0 and no password. After the username is entered with no password, it should go to the desktop. This issue should be resolved in cumulative updates released for Windows 11 in April 2023 and Windows 10 in March 2023:

Windows 11, version 22H2: KB5025239 or later.
Windows 11, version 21H2: KB5025224 or later.
Windows 10, version 22H2: KB5023773 or later.

Note

This issue was only partially fixed and can still occur under certain conditions. For more information, see Auto logon for Kiosk device profile only partially fixed.

TPM attestation isn't working on AMD platforms with ASP fTPM

Date added: December 1, 2022

TPM attestation for AMD platforms with ASP firmware TPM might fail with error code 0x80070490 on Windows systems. This issue is resolved on later versions of AMD firmware. Consult with device manufacturers and firmware release notes for which firmware versions contain the update.

TPM attestation failure with error code 0x81039001

Date added: October 6, 2022

Some devices might intermittently fail TPM attestation during Windows Autopilot pre-provisioning technician flow or self-deployment mode with the error code 0x81039001 E_AUTOPILOT_CLIENT_TPM_MAX_ATTESTATION_RETRY_EXCEEDED. This failure occurs during the Securing your hardware step for Windows Autopilot devices deployed using self-deploying mode or pre-provisioning mode. Subsequent attempts to provision might resolve the issue.

Autopilot deployment report shows "failure" status on a successful deployment

Date added: September 22, 2022

The Autopilot deployment report (preview) shows a failed status for any device that experiences an initial deployment failure. For subsequent deployment attempts, using the Try again or Continue to desktop options, the deployment state in the report doesn't update. If the user resets the device, a new deployment row is shown in the report with the previous attempt remaining as failed.

Autopilot deployment report doesn't show deployed device

Date added: September 22, 2022

Autopilot deployments that take longer than one hour might display an incomplete deployment status in the deployment report. If the device successfully enrolls but doesn't complete provisioning after more than one hour, the device status might not be updated in the report.

Autopilot profile not being applied when assigned

Date added: June 15, 2022

In Windows 10, version 21H2 April 2022 and some May 2022 update releases, there's an issue where the Autopilot profile might fail to apply to the device. Additionally, the hardware hash might not be harvested. As a result, any settings made in the profile might not be configured for the user such as device renaming. To resolve this issue, apply KB5015020 cumulative update or later to the device.

DefaultuserX profile not deleted

Date added: March 28, 2022

When the EnableWebSignIn CSP is used, the defaultuserX profile might not be deleted.

Autopilot reset ran into trouble. Could not find the recovery environment

Date added: March 28, 2022

When an Autopilot reset is attempted, the following message is displayed:

Autopilot reset ran into trouble. Could not find the recovery environment

If there isn't an issue with the recovery environment, enter administrator credentials to continue with the reset process.

Device-based Conditional Access policies

Date added: March 3, 2022

The Intune Enrollment app must be excluded from any Conditional Access policy requiring Terms of Use because it isn't supported. See Per-device terms of use.
Exceptions to Conditional Access policies to exclude Microsoft Intune Enrollment and Microsoft Intune cloud apps are needed to complete Autopilot enrollment in cases where restrictive polices are present such as:
- Conditional Access policy 1: Block all apps except those apps on an exclusion list.
- Conditional Access policy 2: Require a compliant device for the apps on the exclusion list.
In this case, Microsoft Intune Enrollment and Microsoft Intune should be included in that exclusion list of policy 1.

If a policy is in place such that all cloud apps require a compliant device (there's no exclusion list), by default Microsoft Intune Enrollment is excluded, so that the device can register with Microsoft Entra ID and enroll with Intune and avoid a circular dependency.
Hybrid Microsoft Entra devices: When Hybrid Microsoft Entra devices are deployed with Autopilot, two device IDs are initially associated with the same device - one Microsoft Entra ID and one hybrid. The hybrid compliance state displays as N/A when viewed from the devices list in the Azure portal until a user signs in. Intune only syncs with the Hybrid device ID after a successful user sign-in.

The temporary N/A compliance state can cause issues with device based Conditional Access polices that block access based on compliance. In this case, this behavior of Conditional Access is intended. To resolve the conflict, a user must to sign in to the device, or the device-based policy must be modified. For more information, see Conditional Access: Require compliant or Microsoft Entra hybrid joined device.
Conditional Access policies such as BitLocker compliance require a grace period for Autopilot devices. This grace period is needed because until the device is rebooted, the status of BitLocker and Secure Boot aren't captured. Since the status isn't't captured, it can't be used as part of the Compliance Policy. The grace period can be as short as 0.25 days.

Device goes through Autopilot deployment without an assigned profile

Date added: March 2, 2022

When a device is registered in Autopilot and no profile is assigned, the default Autopilot profile is taken. This behavior is by design. It makes sure that all devices registered with Autopilot go through the Autopilot experience. If the device shouldn't go through an Autopilot deployment, remove the Autopilot registration.