> For the complete documentation index, see [llms.txt](https://helpdesk.augmentt.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://helpdesk.augmentt.com/modules/secure/intune/deployment-profiles.md).

# Deployment Profiles

{% hint style="info" %}
This page is a branch of [Intune](/modules/secure/intune.md), covering the **Deployment Profiles** policy category specifically. See that page first for how Templates, Baselines, and Policies relate to each other in general — everything below assumes that model.
{% endhint %}

{% hint style="warning" %}
"Deployment Profiles" here means **Windows Autopilot enrollment profiles** specifically — Augmentt uses this term the same narrow way Microsoft does for this one category. It isn't a synonym for deploying any of the other Intune policy types.
{% endhint %}

Deployment Profiles control what a Windows device does during Out-of-Box Experience (OOBE) when it's enrolled via Windows Autopilot — whether a user signs in, what OOBE screens are shown or skipped, how the device joins Microsoft Entra ID, and whether the resulting primary user gets standard or administrator rights.

## What this category controls

A Deployment Profile template captures a Graph `#microsoft.graph.azureADWindowsAutopilotDeploymentProfile` (`/deviceManagement/windowsAutopilotDeploymentProfiles`). Unlike the other Intune categories, this one is Windows-only — there's no platform selector, since Autopilot deployment profiles only apply to `windowsPc` devices.

## Configuration surface

* **Deployment mode** — User-driven (a user signs in during OOBE and the device is associated with them) vs. Self-deploying (the device runs OOBE with minimal interaction, for kiosk or shared-device scenarios).
* **Convert to Autopilot** — when enabled, targeted devices can register their hardware hash with Windows Autopilot so future OOBE runs receive Autopilot deployments (`extractHardwareHash` / `hardwareHashExtractionEnabled`).
* **Join to Microsoft Entra ID as** — cloud-only Entra join, or hybrid Entra join, during OOBE.
* **Language/region** — OS default (follows the Windows image) or a specific locale; a specific locale typically requires Ethernet at the start of OOBE since Wi-Fi may not be available until language/keyboard are set.
* **Keyboard layout page** — skip it during OOBE (only meaningful when a specific language is chosen).
* **Microsoft Software License Terms (EULA)** — show or hide during OOBE.
* **Privacy settings** — show or hide privacy/diagnostics settings during OOBE.
* **Hide change-account options** — hide the option to use a different account or sign-in method during OOBE.
* **User account type** — whether the primary user ends up as a standard user or a local administrator after enrollment.
* **Pre-provisioning (White Glove)** — allow IT to pre-provision the device before it reaches the end user.
* **Device name template** — a naming pattern applied during Entra join, using Microsoft-supported macros (e.g. `%SERIAL%`, random digits), subject to Intune's device-name length/character limits.
* **Device usage type** — single user vs. shared, set via the out-of-box-experience settings.
* **Assignment** — all devices or specific groups (Autopilot profiles assign to devices, not users).
* **Group tag** — the Autopilot device group tag used for dynamic grouping/targeting.

## Default templates Augmentt ships

Augmentt ships **2 built-in Deployment Profile templates**, unaffiliated with any customer tenant:

### User Driver Autopilot

> "User driven deployment, devices require user credentials and are then associated with appropriate user upon deployment."

```json
{
  "@odata.type": "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile",
  "deviceType": "windowsPc",
  "enableWhiteGlove": false,
  "deviceNameTemplate": "",
  "extractHardwareHash": false,
  "preprovisioningAllowed": false,
  "hardwareHashExtractionEnabled": false,
  "outOfBoxExperienceSetting": {
    "userType": "standard",
    "eulaHidden": true,
    "deviceUsageType": "singleUser",
    "escapeLinkHidden": true,
    "privacySettingsHidden": true,
    "keyboardSelectionPageSkipped": true
  }
}
```

Locale/language: `os-default`. In short: user type **standard**, single-user device, EULA/privacy/change-account screens all hidden, keyboard-selection page skipped, hardware-hash extraction and White Glove pre-provisioning both off.

### Self Deploying Autopilot

> "Converts all targeted devices to Autopilot"

```json
{
  "@odata.type": "#microsoft.graph.azureADWindowsAutopilotDeploymentProfile",
  "deviceType": "windowsPc",
  "enableWhiteGlove": false,
  "deviceNameTemplate": "",
  "extractHardwareHash": true,
  "preprovisioningAllowed": false,
  "hardwareHashExtractionEnabled": true,
  "outOfBoxExperienceSetting": {
    "userType": "standard",
    "eulaHidden": true,
    "deviceUsageType": "shared",
    "escapeLinkHidden": true,
    "privacySettingsHidden": true,
    "keyboardSelectionPageSkipped": true
  }
}
```

Locale/language: `os-default`. The key differences from "User Driver Autopilot": device usage type is **shared** (not single-user) and hardware-hash extraction is **enabled** — matching the self-deploying scenario, where the device itself (not a signed-in user) drives enrollment and its hardware hash needs to be captured/registered as part of that flow.

## Resolves posture check(s)

{% hint style="warning" %}
Augmentt's `SECURE_CHECK_TYPES` / `COMPLIANCE_AUDIT.*` posture-check engine has no dedicated check for Autopilot deployment-profile content itself. These two defaults are provisioning-workflow starting points, not security-hardening controls, so they don't map to a CIS/NIST safeguard the way the Device Configuration and Device Compliance defaults do.
{% endhint %}

The one Intune-adjacent posture check that does exist — **Intune enrollment sign-in frequency** (`intuneenrollmentsigninfrequency`, CIS M365 v6 L1 5.2.2.11 / NIST CSF 2.0) — governs how often a user must re-authenticate *before* enrolling a device via a Conditional Access policy; it isn't a setting on the Deployment Profile itself. See [Conditional Access](/modules/secure/conditional-access.md).

## Related pages

* [Intune](/modules/secure/intune.md)
* [Device Configuration](/modules/secure/intune/device-configuration.md)
* [Conditional Access](/modules/secure/conditional-access.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://helpdesk.augmentt.com/modules/secure/intune/deployment-profiles.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.