An organisation is comparing classic Windows Autopilot deployment profiles with Windows Autopilot device preparation policies before it rebuilds its provisioning process. Which statement correctly describes how each approach identifies the device that is about to be provisioned?
- ABoth approaches require the device hardware identity to be imported into the tenant list of Autopilot devices first, and both then deliver their settings to that device during the out-of-box experience.
- BA device preparation policy is assigned to a device group whose membership comes from imported hardware identities, while a classic deployment profile is assigned to the user who signs in during the out-of-box experience.
- CA device preparation policy identifies the device by its domain join configuration, so the device has to be joined to Active Directory before the policy applies and no registration in the tenant is required.
- DA classic deployment profile is delivered to a device that was registered as an Autopilot device in the tenant beforehand, while a device preparation policy is assigned to a user group and depends on Intune adding the provisioned device to a device group that it owns. Correct
Why A is wrong: It is tempting because hardware identity import is the step most administrators associate with Autopilot, and it is genuinely mandatory for a classic deployment profile. It is wrong because a device preparation policy provisions a device that was never imported, which is the main reason the newer approach exists.
Why B is wrong: It is tempting because a device preparation policy does involve a device group, so that group looks like the targeting object. It is wrong because the assignment is made to a user group and the device group is populated by Intune during provisioning, and a classic deployment profile targets registered devices rather than users.
Why C is wrong: It is tempting because hybrid scenarios do rely on a domain join configuration to complete provisioning. It is wrong because device preparation provisions a Microsoft Entra joined device and does not identify it through an on-premises domain join at all.
Why D is correct: Correct. The classic flow matches a device to a profile using the device identity already held in the tenant, so an unregistered device receives nothing. Device preparation inverts that: the signed-in user carries the policy, and Intune places the device into the security group it owns as part of provisioning.