Edit

Share via

Enroll Windows devices

  • Article

Applies to:

  • Windows 10
  • Windows 11
  • Windows 11 SE

After you set up Intune for Education with your information (such as student records, apps, and settings for devices), you can add school devices. New devices connect with and enroll in Intune during initial device setup. There are two ways to add and enroll devices:

  • Provisioning package

  • Windows Autopilot

This article provides an overview of how to add Windows client devices to Intune for Education, and describes enrollment options and best practices.

Prerequisites

A Microsoft Entra ID P1 license is required. This license is included with Microsoft 365 A1 and Intune for Education.

A reliable internet connection is required. If you have a low-bandwidth network, we recommend setting up devices via a provisioning package. With Autopilot, the configuration is minimal and students can set up devices on their home network. The provisioning time for both methods increases based on the number of concurrent device setups, network bandwidth, and size of required apps.

For more information, see:

Provisioning package overview

A provisioning package (.ppkg) is a file that contains configuration settings, and is used to quickly and efficiently configure Windows client devices without installing a new image. This method ensures that school devices have a standard set of apps and settings when students start using them. You can run the package file on the desktop to deploy it, or insert a USB key with the saved package during the Windows Out of Box Experience (OOBE). Devices are ready for sign-in and school use when students or teachers receive them. We recommend utilizing provisioning packages for bulk enrollment and shared device scenarios.

Tip

Even if you're using custom OS images to configure the initial apps and settings, you can create a provisioning package for the sole purpose of enrolling devices in Microsoft Intune.

You can use Windows Configuration Designer or the Set up School PCs app to create a provisioning package. Both tools guide you through the configuration process. Devices continue to sync with Intune in the background after provisioning. You can track provisioning progress on the Enrollment Status Page to ensure all required mobile device management policies and apps are delivered before student use.

For bulk enrollment, remember that the bulk enrollment token expires 180 days after you create it. To continue using the same provisioning package, update the token before it expires. After the token expires, you must update the token or create a new provisioning package.

To prepare a provisioned device for a new student, school year, or scenario, you must reapply the provisioning package. We recommend using Windows Autopilot Reset to retain Microsoft Intune enrollment. You don't need to register devices with Autopilot to use Windows Autopilot Reset.

For more information, see:

Windows Autopilot overview

Windows Autopilot is a collection of technologies that simplifies the setup and configuration of new school devices. You can deploy Windows Autopilot-registered devices with required school apps and settings. With this method, there's no need for imaging. Devices are ready for sign-in and use when students and teachers connect to Wi-Fi. To set up devices with Windows Autopilot:

  1. Register the device with Autopilot in the Microsoft Intune admin center or Partner center.

  2. Create and assign an Autopilot deployment profile, Enrollment Status Page (ESP) profile, apps, and policies.

Make sure there's a reliable internet connection at your enrollment site, especially if you're enrolling more than one device at the same time. To reduce setup time for students and teachers, use Windows Autopilot to preprovision devices, or enlist an OEM or Microsoft partner to preinstall apps and policies.

You can set up Windows Autopilot in Intune for Education or the Microsoft Intune admin center. For more information and how-to guides, see:

When to use provisioning package vs Windows Autopilot

Use the following table to assess your own school's environment and setup needs, and compare provisioning methods.

Points to consider Provisioning package Windows Autopilot
Licensing A Microsoft Entra ID P1 license is required. A Microsoft Entra ID P1 license is required.
Custom OS images You can use custom OS images to configure initial apps and settings. You can preprovision Autopilot devices, which lets you, a Microsoft partner, or OEM preinstall apps and policies. Devices must remain in the OOBE after you apply the images, because Autopilot provisioning only kicks in during the OOBE.
IT staff IT staff unboxes the device, powers on the device, and configures the device. Autopilot provisioning is optimized for limited engagement from IT staff, so students and teachers can unbox the device, turn on the device, and complete the initial configuration.
OEM and partners A partner can enroll devices on behalf of your school. An OEM or partner can enroll devices on behalf of your school. They must first register device IDs in the Windows Autopilot service. To further reduce IT engagement and end-user provisioning time, they can preprovision devices.
Device user Commonly used for shared devices, but also supported on devices associated with a single user. A primary user isn't assigned. User-driven mode is commonly used for devices assigned to a single user. Self-deploying mode is commonly used for shared devices.
Apps For information about supported apps, see Provision PCs with apps. Silent installation is required for Win32 apps and must be configured in the provisioning package. All app types are supported. To further reduce deployment time and network load during deployment, preprovision devices, and enable silent installation for Win32 apps.
Network A reliable internet connection is required. Best for low-bandwidth networks. A reliable internet connection is required. Network bandwidth consumption depends on the number of concurrent device setups and size of required apps. Students can set up devices on their home network.
First day of class Devices are ready for sign-in and use immediately. Students connect the device to Wi-Fi and complete the remaining setup steps. To further reduce end-user steps, preprovision devices.

Next steps