How to find failed Autopilot deployments in Microsoft Intune

Before you start

Use an Intune Administrator, or an account with an Intune role that can read managed devices, such as Read Only Operator. The tenant needs an active Intune licence. The PowerShell example requests DeviceManagementManagedDevices.Read.All; your organisation may require administrator consent.

The events come from the beta API, which Microsoft says changes more often than version 1.0. Microsoft says the data is there for 30 days after a deployment, and that the user part of Autopilot pre-provisioning makes no record. The examples read and export and change nothing.

Option 1

Find failed Autopilot deployments with PowerShell

Install the modules once, then connect, read the deployment events and export the failed ones.

# Install once, if the modules are not already installed.
Install-Module Microsoft.Graph.Authentication,
    Microsoft.Graph.Beta.DeviceManagement.Enrollment -Scope CurrentUser

$ErrorActionPreference = 'Stop'
Connect-MgGraph -Scopes 'DeviceManagementManagedDevices.Read.All' -NoWelcome
try {
    $events = @(Get-MgBetaDeviceManagementAutopilotEvent -All)
    $columns = 'DeploymentStartDateTime', 'ManagedDeviceName', 'DeviceSerialNumber',
        'UserPrincipalName', 'WindowsAutopilotDeploymentProfileDisplayName',
        'DeviceSetupStatus', 'AccountSetupStatus', 'OSVersion', 'EnrollmentFailureDetails'
    $report = @($events | Where-Object { "$($_.DeploymentState)" -eq 'failure' } |
        Sort-Object DeploymentStartDateTime -Descending | Select-Object $columns)
    if ($report.Count -eq 0) {
        Write-Output "None of the $($events.Count) recent Autopilot deployments failed."
    } else {
        $report | Export-Csv -Path './failed-autopilot.csv' -NoTypeInformation -Encoding utf8
        Write-Output "$($report.Count) of $($events.Count) recent deployments failed."
    }
} finally {
    Disconnect-MgGraph | Out-Null
}

The CSV has 1 row for each failed deployment, the newest first, with its start time in UTC. DeviceSetupStatus and AccountSetupStatus say which part of the enrolment status page failed, and EnrollmentFailureDetails holds the reason Intune recorded. To include deployments that timed out and were clicked past, add -or "$($_.DeploymentState)" -eq 'successWithTimeout' inside the Where-Object.

Check a single device

Reconnect with Connect-MgGraph, then read 1 device's deployments by its serial number. The export above disconnects when it finishes.

# Run while connected to Microsoft Graph. Replace the example serial number.
Get-MgBetaDeviceManagementAutopilotEvent -All |
    Where-Object { $_.DeviceSerialNumber -eq 'EXAMPLE-1234' } |
    Select-Object DeploymentStartDateTime, DeploymentState, DeviceSetupStatus,
        AccountSetupStatus

Option 2

Review Autopilot deployments in the admin centre

1. Sign in to the Microsoft Intune admin centre for the correct tenant.
2. Go to Devices > Monitor and select Windows Autopilot deployments.
3. Sort or filter the list by its deployment status to bring the failed deployments together.
4. Select a device to read its deployment details. Leave the page without changing anything.

This suits a look at last week's rollout in Microsoft's own report. It holds 30 days, so to keep a record month to month, export it with PowerShell or a report.

Common questions

Why does a device still show failed after the user tried again?

Microsoft says the report keeps a failed status after an initial failure, and choosing Try again or Continue to desktop on the device doesn't update it. A reset adds a new row and leaves the earlier attempt as failed, so read the newest row for each serial number.

Where are Windows Autopilot device preparation deployments?

They have a report of their own. In the Intune admin centre, go to Devices > Monitor and select Windows Autopilot device preparation deployments, which shows each deployment's status and the phase it reached.

Why is a device missing from the deployments?

Only a new Intune enrolment makes a record, and records last 30 days. Check that the device is registered with Autopilot at all; see how to export Autopilot devices in Microsoft Intune.