{"id":8,"date":"2026-03-13T07:52:47","date_gmt":"2026-03-13T07:52:47","guid":{"rendered":"https:\/\/vanbeekcloud.nl\/?p=8"},"modified":"2026-03-21T09:28:03","modified_gmt":"2026-03-21T09:28:03","slug":"autopilot-pre-provisioning-the-complete-troubleshooting-guide","status":"publish","type":"post","link":"https:\/\/vanbeekcloud.nl\/index.php\/2026\/03\/13\/autopilot-pre-provisioning-the-complete-troubleshooting-guide\/","title":{"rendered":"Autopilot Pre-Provisioning: The Complete Troubleshooting Guide"},"content":{"rendered":"\n\n \n
\n

In this article<\/h4>\n
    \n
  1. What is pre-provisioning (white glove)?<\/a><\/li>\n
  2. How the process works under the hood<\/a><\/li>\n
  3. Prerequisites checklist<\/a><\/li>\n
  4. Common failures and how to fix them<\/a><\/li>\n
  5. Collecting and reading diagnostic logs<\/a><\/li>\n
  6. ESP timeout deep dive<\/a><\/li>\n
  7. TPM attestation failures<\/a><\/li>\n
  8. Hybrid Azure AD join issues<\/a><\/li>\n
  9. Network and proxy pitfalls<\/a><\/li>\n
  10. Get-AutopilotDiagnosticsCommunity<\/a><\/li>\n
  11. Final pre-flight checklist<\/a><\/li>\n <\/ol>\n <\/div>\n\n \n
    \n

    1. What is pre-provisioning?<\/h3>\n

    \n Pre-provisioning (formerly known as white glove) allows IT teams or hardware vendors to fully configure a Windows device before<\/em> the end user ever touches it. The device goes through Autopilot enrollment, installs all required apps, applies all policies and reaches a ready-to-use state \u2014 all without any user interaction.\n <\/p>\n

    \n The benefit is obvious: the user opens the laptop lid, signs in, and everything is already there. No waiting for apps to install. No “please wait while we set up your device” spinning for 45 minutes. The challenge? When pre-provisioning fails, it can be incredibly frustrating to diagnose because the error messages are often vague and the logs are buried deep.\n <\/p>\n <\/div>\n\n \n

    \n

    2. How the process works under the hood<\/h3>\n

    \n Understanding the flow is essential for troubleshooting. Pre-provisioning runs through these phases in order:\n <\/p>\n

    \n
    \n
    \n 1<\/span>\n <\/div>\n
    \n

    TPM attestation<\/p>\n

    The device proves its identity to the Autopilot service using the TPM chip. A hardware hash is matched against the registered device in your tenant.<\/p>\n <\/div>\n <\/div>\n

    \n
    \n 2<\/span>\n <\/div>\n
    \n

    Entra ID join (or hybrid join)<\/p>\n

    The device registers in Entra ID. For hybrid scenarios, the Intune Connector creates a computer object in on-premises AD and the device waits for the sync to complete.<\/p>\n <\/div>\n <\/div>\n

    \n
    \n 3<\/span>\n <\/div>\n
    \n

    MDM enrollment<\/p>\n

    The device enrolls in Intune and receives its management profile.<\/p>\n <\/div>\n <\/div>\n

    \n
    \n 4<\/span>\n <\/div>\n
    \n

    Device ESP \u2014 policies and apps<\/p>\n

    The Enrollment Status Page tracks the installation of all device-targeted policies, certificates, network profiles and required Win32\/LOB apps.<\/p>\n <\/div>\n <\/div>\n

    \n
    \n ✓<\/span>\n <\/div>\n
    \n

    Reseal<\/p>\n

    The device reseals back to the OOBE screen. The technician presses the power button and the device is ready for the user.<\/p>\n <\/div>\n <\/div>\n <\/div>\n

    \n

    Key insight:<\/strong> Pre-provisioning only runs the device<\/em> ESP phase. The user ESP (user-targeted apps and policies) runs after the end user signs in. If you are assigning apps in user context, they will not install during pre-provisioning \u2014 this is by design, not a bug.<\/p>\n <\/div>\n <\/div>\n\n \n

    \n

    3. Prerequisites checklist<\/h3>\n

    \n Before you even start troubleshooting a failure, verify that these are all in place. Missing one of these is the root cause in the majority of cases I see:\n <\/p>\n

    \n