How to export Autopilot profiles in Microsoft Intune

Before you start

Use an Intune Administrator, or an account with an Intune role that can read enrolment settings, such as Read Only Operator. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementServiceConfig.Read.All; your organisation may require administrator consent.

The profiles are read live. From May 2024 Microsoft replaced several properties with new names and marked the old ones deprecated, so the script reads each new name and falls back to the old one. The beta API changes more often than version 1.0. The examples read and export and change nothing.

Option 1

Export Autopilot profiles with PowerShell

Install the modules once, then connect, read each profile and its assignments and export them.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication,
    Microsoft.Graph.Beta.DeviceManagement.Enrollment -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementServiceConfig.Read.All' -NoWelcome
try {
    $items = @(Get-MgBetaDeviceManagementWindowsAutopilotDeploymentProfile -All)
    $report = foreach ($item in $items) {
        # The newer names first, then the ones used before May 2024.
        $oobe = $item.OutOfBoxExperienceSetting
        if (-not $oobe.DeviceUsageType) { $oobe = $item.OutOfBoxExperienceSettings }
        $locale = $item.Locale
        if (-not $locale) { $locale = $item.Language }
        $preProvisioning = $item.PreprovisioningAllowed
        if ($null -eq $preProvisioning) { $preProvisioning = $item.EnableWhiteGlove }
        $convert = $item.HardwareHashExtractionEnabled
        if ($null -eq $convert) { $convert = $item.ExtractHardwareHash }
        $request = @{ WindowsAutopilotDeploymentProfileId = $item.Id; All = $true }
        $targets = Get-MgBetaDeviceManagementWindowsAutopilotDeploymentProfileAssignment @request |
            ForEach-Object {
                $target = $_.Target.AdditionalProperties
                $kind = "$($target['@odata.type'])" -replace '^#microsoft\.graph\.', ''
                "$kind $($target['groupId'])".Trim()
            }
        $type = "$($item.AdditionalProperties['@odata.type'])" -replace '^#microsoft\.graph\.', ''
        [pscustomobject]@{
            Profile = $item.DisplayName
            Type = $type
            DeviceUsage = $oobe.DeviceUsageType
            UserType = $oobe.UserType
            NameTemplate = $item.DeviceNameTemplate
            Locale = $locale
            PreProvisioning = $preProvisioning
            ConvertDevices = $convert
            DeviceType = $item.DeviceType
            Assignments = @($targets) -join '; '
            Modified = $item.LastModifiedDateTime
        }
    }
    $report = @($report | Sort-Object Profile)
    if ($report.Count -eq 0) {
        Write-Output 'The tenant has no Windows Autopilot deployment profiles.'
    } else {
        $report | Export-Csv -Path './autopilot-profiles.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) deployment profiles written to autopilot-profiles.csv."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each profile. Type is azureADWindowsAutopilotDeploymentProfile for Entra join and activeDirectoryWindowsAutopilotDeploymentProfile for hybrid join, DeviceUsage is singleUser for user-driven and shared for self-deploying, and Assignments lists each target with its group ID, exclusions included. ConvertDevices is the Convert all targeted devices to Autopilot setting. To add the hidden setup pages, add $oobe.EulaHidden and $oobe.PrivacySettingsHidden to the row; in the older settings they're HideEULA and HidePrivacySettings.

Option 2

Review deployment profiles in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Select Devices, then under By platform select Windows.
3. Under Device onboarding, select Enrollment, then under Windows Autopilot select Deployment profiles.
4. Select a profile and read its Properties: the out-of-box settings and the groups it's assigned to. Leave Edit alone, so nothing changes.

This suits checking 1 profile before a deployment. There's no export of the settings here, so a record of every profile, kept from one month to the next, takes PowerShell or a report.

Common questions

What happens to a device with no profile assigned?

Microsoft says a device registered in Windows Autopilot with no profile assigned gets the default Windows Autopilot profile. If a device shouldn't go through Autopilot at all, remove its registration.

Why didn't a profile change reach a device?

Microsoft says a changed profile applies to the devices assigned to it, but a device already enrolled in Intune gets it only after it's reset and enrolled again. Profile assignment also takes a while after a device joins an assigned group.

Which devices use each profile?

Each Autopilot device shows its profile and whether it's assigned. See how to export Windows Autopilot devices in Microsoft Intune.