Is there a way to enforce Autopilot/MDM enrollment even if a user bypasses internet during OOBE and creates a local account?

Question

Is there a way to enforce Autopilot/MDM enrollment even if a user bypasses internet during OOBE and creates a local account?

Anant Bera 271

Hi all,

I have a scenario I'd like to get clarity on regarding Windows Autopilot and a potential security gap.

Scenario:

We configure a device for Windows Autopilot (Azure AD Join, User-Driven) and ship it to the end user.
Instead of connecting to the internet during OOBE, the user either skips the network setup screen or continues signing in without internet and creates a local administrator account instead.
The device boots fully into the local Windows desktop without ever triggering Autopilot or MDM enrollment.
Later, the user connects to the internet while already signed into the local account, uses the device normally, and shuts it down.
On subsequent boots, the user signs into the same local account with the internet turned off.

Environment: Windows 11/10, Microsoft Intune, Microsoft Entra ID, Autopilot Azure AD Join (User-Driven) profile.

Is there any policy or control that can be implemented to prevent users from bypassing the enrollment process and creating a local account during OOBE?

Thanks in advance!

Rahul Jindal 11,641 Reputation points

2026-06-17T21:12:13.8633333+00:00

There is no policy to force the enrolment, however, you can get around the security issue by enforcing CA policy where access to corporate data is only allowed through a compliant device. Also, you can introduce Pre-provisioning in the mix where local IT initiates the Autopilot process and seals the device before shipping it to the user to complete the user setup phase.

1 answer

Your answer

Rahul Jindal 11,641 Reputation points

2026-06-17T21:12:13.8633333+00:00

There is no policy to force the enrolment, however, you can get around the security issue by enforcing CA policy where access to corporate data is only allowed through a compliant device. Also, you can introduce Pre-provisioning in the mix where local IT initiates the Autopilot process and seals the device before shipping it to the user to complete the user setup phase.

Answer 1

No policy can force Autopilot/MDM enrollment if the user completes OOBE entirely offline and creates a local account first. Autopilot and automatic Microsoft Entra/Intune enrollment depend on the device being online during OOBE so it can:

Contact the Windows Autopilot service and download the assigned Autopilot profile.
Join Microsoft Entra ID and enroll in Intune as part of the user-driven workflow.

From the documented Autopilot behavior:

When a Windows device boots and is connected to the internet, it attempts to contact the Autopilot service and download its profile during OOBE. This profile then drives the user-driven flow (Microsoft Entra join, Intune enrollment, and configuration).
The user-driven mode assumes the user connects to a network and signs in with organizational credentials during OOBE; then the device joins the organization and enrolls in Intune.

If the user never connects to the internet during OOBE, the device cannot:

Reach the Autopilot service to download the profile.
Perform Microsoft Entra join.
Trigger automatic Intune enrollment.

Because of that, there is no supported Intune/Autopilot setting that can retroactively “force” Autopilot enrollment on a device that was fully set up offline with a local account.

Mitigations are therefore procedural/operational rather than technical in this scenario, for example:

Ensuring users are instructed (and required by process) to connect to the internet and sign in with their work/school account during first boot.
Using deployment models (such as pre-provisioning or self-deploying where appropriate) where IT or a technician completes OOBE online before handing over the device.

References: