MP.RKS.IA.1006: Windows devices are registered in Windows Autopilot
| ID | MP.RKS.IA.1006 |
| Severity | Low |
| Suite | RKSolutions Intune Anomalies |
| Product | Intune |
| Feature | Device enrollment |
| Security area | Devices and endpoints |
| Resource type | Device |
| User impact of fixing | Low |
| Effort to fix | Medium |
| Provides evidence for | ISO 27001:2022: A.8.1 (partial), A.5.9 (partial)UAE IA v1.1: T5.7.1 (partial), T1.2.1 (partial)What this means |
| Reads from | Microsoft Graph |
| Licence needed | INTUNE_A |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Devices registered in Windows Autopilot (with a hardware hash or a corporate identifier for Autopilot device preparation) are recognised as company devices when they are reset, and enrol again on their own. A device that is not registered can be reset and set up as a personal device. The test lists physical Windows devices with neither a hardware hash nor a corporate identifier. Cloud PCs are left out.
Remediation action
Section titled “Remediation action”- Upload the hardware hash of each device below (Get-WindowsAutopilotInfo), or add its corporate identifier.
- In the Microsoft Intune admin center, go to Devices > Enrollment > Windows Autopilot > Devices and import them.
Related links
Section titled “Related links”- Microsoft Learn - Add devices to Windows Autopilot
- Microsoft Learn - Corporate identifiers for Autopilot device preparation
Mito check, based on RKSolutions Intune Anomalies by Roy Klooster. Author: royklo. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.