Microsoft Intune is the service that manages devices: enrolling them, pushing configuration and applications, checking they meet your rules, and wiping them when someone leaves.

The base product is Intune Plan 1, included in Microsoft 365 E3 and above. The Intune Suite add-on layers on Remote Help; Endpoint Privilege Management, which grants administrator rights just for the moment they are needed instead of leaving people permanently as local admins; Advanced Analytics; a managed certificate authority (Cloud PKI); a lightweight VPN for unenrolled phones (Microsoft Tunnel); and an enterprise application catalogue.

The problem Autopilot solves: traditionally IT built a custom Windows image, and every new laptop had to physically pass through their hands. Autopilot removes that step entirely.

A device is registered against your tenant by its hardware identifier — captured automatically by the manufacturer or reseller at the point of sale, or harvested afterwards from a running machine with a PowerShell script and imported as a spreadsheet. The device then ships direct to the employee, still with the manufacturer's stock Windows on it. They open it, connect to any network, sign in with their work account, and the machine joins Entra ID, enrols in Intune, receives its policies and applications, and customises its own setup experience. No image, no IT touch.

Autopilot device preparation is the current-generation flow, generally available since 3 June 2024. Its central improvement is enrolment-time grouping: the device joins its target security group at the moment it enrols, rather than waiting for group membership to be recalculated, so application and policy assignment starts immediately instead of after an unpredictable delay. It needs Windows 11 24H2 or later and is Entra-join only.

You will see this called ‘Autopilot v2’ in blogs and forums. That name appears in no Microsoft documentation — it is a community nickname.

For machines you already own, Autopilot for existing devices re-images them in place into the same flow. It requires Configuration Manager, not Intune alone, which is a common and unwelcome surprise.

The choice is a trade, and it is worth stating both sides. A slower channel gives you a stable target for testing your macro-heavy spreadsheets and line-of-business add-ins. It also means banking up to six months of change into one event — so when it lands, you get six months of surprises at once, and your users have been watching everyone else use features they do not have.

A ring is a group of devices that receives a change before the next group does. Microsoft's guidance is deliberately a process rather than a fixed number: pre-release test devices, then special-purpose machines moved onto a long-term servicing channel, then volunteer pilots chosen to cover the widest variety of hardware and applications, then broad rollout.

One piece of Microsoft's advice is counter-intuitive and correct: rings should deliberately split individual departments across several rings. The stated reasoning — if you were to encounter an issue, you don't prevent any critical business from continuing. The instinct is to move a whole department at once because it is tidier to communicate. That instinct concentrates your blast radius onto one team's ability to do its job.

Any specific number of rings, or specific deferral periods, is consultant practice layered on top — Microsoft does not prescribe one.