Autopilot Device Association vs the Hardware Hash: What Changed and Why

For years, getting a Windows device into Autopilot meant one thing: register its hardware hash. In August 2026 Microsoft added a second way to tie a device to your tenant before enrollment, called device association. It uses a different mechanism, lives in a different place, and comes with its own rules for setup and decommissioning.

This post explains how each method works, what device association changes, and where it fits today.

The short version

• Hardware hash registration belongs to classic Windows Autopilot. The device’s hash sits in Microsoft’s Autopilot service, linked to your tenant. When the device starts setup, the service recognizes it and hands it your Autopilot profile.
• Device association belongs to Autopilot device preparation. Intune verifies the device through its TPM and writes a marker with your tenant information into the device’s UEFI firmware. The binding travels with the hardware.

Device association doesn’t replace hardware hash registration. Classic Autopilot keeps using the hash, and Microsoft keeps investing in both.

How hardware hash registration works

A hardware hash is a fingerprint built from details about the device: manufacturer, model, serial number, hard drive serial number, when Windows generated the hash, and other attributes. Registration means uploading that hash to the Windows Autopilot service and linking it to your tenant. Registration also creates a Microsoft Entra device object, which Autopilot uses to identify the device before anyone signs in.

Most organizations let the manufacturer or reseller register devices at purchase. You can also collect hashes yourself with Configuration Manager, the Get-WindowsAutopilotInfo script or the diagnostics page in OOBE, and import up to 500 devices per CSV.

Microsoft positions manual hash uploads through Intune as a testing option. Its documentation gives two reasons: free and low-cost Intune accounts lack strong vetting, and “4K hardware hashes contain sensitive information that only device owners should maintain.”

The service tolerates small changes. A hash generated twice looks different because it includes a timestamp, and a device with a replaced hard drive keeps matching. A replaced motherboard doesn’t match, so you upload a new hash.

What device association is

Device association is an optional feature of Autopilot device preparation, the newer Autopilot architecture that runs on Windows 11 with Microsoft Entra join. It binds a physical device to your tenant before enrollment through the device’s TPM.

Microsoft describes three operations:

• Pre-associate. An Intune admin uploads the device’s details. The service stores the intent to associate.
• Associate. During OOBE, the device proves its TPM-backed identity. If it matches the pre-association, Autopilot writes a tenant affinity marker into UEFI firmware.
• Remove association. Someone with access to the device runs a PowerShell script that clears the marker from UEFI.

How device association works, step by step

1. Create a device preparation policy with the apps, scripts and OOBE settings you want.
2. Export the device information. Boot the device to the region selection page in OOBE, press the Windows key five times, and choose Export device information in the Autopilot menu. The device writes a DeviceLink CSV to a USB drive. For a device in use, you find the same CSV in its Autopilot diagnostic logs, which you can collect from Settings, with MdmDiagnosticsTool.exe, or remotely from Intune.
3. Pre-associate in Intune. Go to Devices > Enrollment > Device association > Devices, select Add, upload the CSV and, if you want, assign a device preparation policy to that specific device.
4. Associate. When the device connects to a network in OOBE, it finds the pre-association record and completes association on its own. A technician can also trigger it from the Autopilot menu, which shows Association complete.
5. Enroll. The device enrolls as corporate-owned, gets the device-targeted policy and shows the OOBE customizations you configured.

The Autopilot menu also offers Scan QR code. Intune only accepts the CSV today, but a custom app that calls Microsoft Graph can use the QR code instead. The community tool AutopilotQR does this from a phone browser.

What device association adds to device preparation

Before August 2026, device preparation couldn’t tie a policy to a specific device. The policy followed the user, and the only way to mark devices as corporate was to upload corporate identifiers: serial number, manufacturer and model. Association adds:

• Device-targeted policies. You assign a device preparation policy to the device itself, and it takes precedence over the user’s policy. One user can set up several devices, each with its own policy.
• Automatic corporate ownership. Associated devices pass enrollment restrictions that block personal devices, with no corporate identifier upload.
• A shorter OOBE. You can preset the language, skip the keyboard page, hide the license terms and privacy pages, and hide the change account options. On Windows Pro, associated devices also skip the personal or work account page.
• Naming at enrollment. A template with %SERIAL% or %RAND:x% names the device from the start.
• Hardware-verified trust. Intune checks the TPM-backed identity before enrollment, instead of trusting identifiers someone typed into a CSV.

Classic Autopilot users will recognize most of this list. Registration has long given classic Autopilot pre-enrollment recognition, OOBE customization and naming. Device association brings the same benefits to device preparation, and anchors them in the TPM instead of a hash in a cloud list.

Side by side

	Hardware hash registration	Device association
Used by	Classic Windows Autopilot	Autopilot device preparation
Identifies the device by	Hardware hash (serial numbers, model and more)	TPM-backed identity, verified through attestation
Where the binding lives	Windows Autopilot service	Pre-association record in the service, then a marker in UEFI firmware
Who can set it up today	OEM, reseller, CSP or your own admins	Your Intune admins (OEMs and partners planned)
Bulk upload	Up to 500 devices per CSV	One device per CSV
Supported Windows	Windows 10 and Windows 11	Windows 11 24H2 or 25H2 with KB5120998 or later
Virtual machines	Supported for testing	Not supported
Survives a Windows reset	Yes, the record stays in the service	Yes, the marker stays in firmware
Removal	Deregister in Intune	Clear the UEFI marker on the device, then delete the record in Intune

Why Microsoft is moving in this direction

Microsoft’s announcement focuses on what association enables, not on problems with the hash. Reading the documentation side by side, three reasons stand out to me:

• Device preparation needed a pre-enrollment identity. It was built without registration. Association gives it device targeting and corporate marking without bringing the hash back.
• Proof beats a list. A hash or a serial number in a CSV tells Intune what a device claims to be. A TPM attestation proves the device presents the hardware-backed identity Intune expects.
• Microsoft treats the 4K hash as sensitive. Its own guidance steers admins away from uploading hashes through Intune outside testing. Association moves that trust into hardware the organization has in hand.

The FAQ states that OEMs and partners will be able to pre-associate devices in the future. That will matter most, because it brings back the factory-to-user shipping that classic Autopilot handles today.

What to watch out for

• Requirements are strict. You need a physical device with a healthy TPM 2.0 that isn’t in reduced functionality mode, a supported Windows 11 build and edition, and network access to ztd.dds.microsoft.com plus Microsoft’s Azure Attestation endpoints. Sovereign clouds and Windows 365 aren’t supported.
• It’s hands-on today. Someone boots each device, exports a CSV to USB and uploads it, one device at a time. That suits a staging bench or a technician rollout. It doesn’t suit laptops shipped straight to employees’ homes.
• Removal needs the device in hand. A registered hash and an association both survive a Windows reset or reinstall, so a wiped device still belongs to your tenant. The difference is where the binding lives. You deregister a hash in Intune without touching the device. The association sits in the device’s firmware, Intune can’t remove it, and Microsoft treats whoever holds the device as its owner for association purposes. Someone has to clear the marker on the device itself.
• Order matters when you decommission. Unenroll the device first, then clear the four DeviceLink UEFI variables on the device, then delete the record in Intune. If the device remains enrolled when you clear the marker, Intune tries to re-associate it at the next check-in.
• Firmware changes reset the identity. Resetting BIOS/UEFI settings or changing Secure Boot changes the device’s identity. You then export and upload a new CSV. The service deletes the old, stale record after 360 days.
• Registered and associated devices follow association. If a device has both, device preparation runs. If it’s registered but not associated, classic Autopilot runs.

Which should you use?

Stay with hardware hash registration if your devices ship from the vendor to users, you need hybrid join, pre-provisioning or self-deploying mode, or you run Windows 10.

Try device association if you use device preparation, you prepare devices on a bench or with technicians, and you want device-targeted policies, a shorter OOBE or naming without uploading corporate identifiers.

Add a removal step to your decommissioning, RMA and resale procedures before you associate your first production device, so no laptop leaves with your tenant marker in its firmware.

Sources: Overview of Windows Autopilot device association, Associate devices, Requirements, FAQ, Lifecycle management, Remove association, Windows Autopilot registration overview, Manually register devices, Compare device preparation and Windows Autopilot, Introducing device association (Microsoft Tech Community)