How to Look Up a Windows Autopilot Device by Serial Number Using PowerShell

You have a serial number. You need to know if that device is registered in Windows Autopilot, which deployment profile is assigned to it, and whether it has ever checked in. Hunting through the Intune portal one device at a time works for one device. It does not work for ten.

The Microsoft Graph PowerShell cmdlet Get-MgDeviceManagementWindowsAutopilotDeviceIdentity with the -Filter parameter solves this in one line. This post covers the exact syntax, what the output fields mean, and how to run bulk serial number lookups from a CSV.

Why the Intune Portal Falls Short for This

In the Intune admin center, you can browse to Devices > Enrollment > Windows > Windows Autopilot devices. You can search by serial number — one at a time — using the search box. There is no bulk search, no export-and-filter workflow, and no way to query by serial number from a list.

The Graph API gives you the full filtered list. One command. Any number of serial numbers.

Step 1 — Install the Module and Connect

The cmdlet is in the Microsoft.Graph.DeviceManagement.Enrollment module. If you have the full Microsoft.Graph module installed, you already have it. If not, install just the sub-module:

# Install if not already present (run as admin)
Install-Module -Name "Microsoft.Graph.DeviceManagement.Enrollment" -Scope CurrentUser

# Connect with read-only Autopilot permission
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.Read.All"

After running Connect-MgGraph, a browser window opens asking you to sign in with your Entra ID admin account. Once authenticated, the shell confirms the connection:

Step 2 — Look Up a Single Device by Serial Number

The -Filter parameter takes an OData v4 filter expression. For an exact serial number match, the syntax is serialNumber eq 'VALUE'. The property name is camelCase and the value is in single quotes:

# Exact serial number lookup (OData eq operator)
$serial = "ABC123XYZ456"
$device = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -Filter "serialNumber eq '$serial'"

# Show the key fields
$device | Select-Object SerialNumber, GroupTag, EnrollmentState, Manufacturer, Model, ManagedDeviceId, DisplayName

If the device is registered, you will see output like this:

If the command returns nothing (no output, no error), the serial number is not registered in your Autopilot tenant. That is the most common result when troubleshooting an OOBE failure — the hardware hash was never uploaded.

Understanding the Response Fields

Step 3 — Bulk Lookup from a CSV

The real time-saver is running a list of serial numbers from procurement or a helpdesk ticket. Create a CSV with a column called SerialNumber, then run this loop:

# Import serial numbers from CSV (must have a 'SerialNumber' column)
$serials = Import-Csv -Path "C:\Temp\device-serials.csv"
$results = @()

$serials | ForEach-Object {
    $sn = $_.SerialNumber.Trim()
    $device = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -Filter "serialNumber eq '$sn'"

    $results += [PSCustomObject]@{
        SerialNumber    = $sn
        Registered      = $null -ne $device
        GroupTag        = $device?.GroupTag
        EnrollmentState = $device?.EnrollmentState
        Model           = $device?.Model
        ManagedDeviceId = $device?.ManagedDeviceId
    }
    Write-Host "$sn — $($null -ne $device ? 'FOUND' : 'NOT REGISTERED')"
}

# Export results
$results | Export-Csv -Path "C:\Temp\autopilot-check-$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation
Write-Host "Results exported. Registered: $($results | Where-Object Registered).Count) / $($results.Count)"

The output CSV will have one row per serial number with a Registered column (True/False), Group Tag, enrollment state, and model. You can send this directly to procurement as confirmation of what is and is not in your Autopilot tenant.

Step 4 — Updating a Group Tag via Graph

If the lookup reveals the wrong Group Tag is set (or no Group Tag at all), you can update it without going into the portal. You need the device's Autopilot identity ID first:

# Reconnect with write permission
Connect-MgGraph -Scopes "DeviceManagementServiceConfig.ReadWrite.All"

# Get the device identity ID
$device = Get-MgDeviceManagementWindowsAutopilotDeviceIdentity -Filter "serialNumber eq 'ABC123XYZ456'"

# Update the Group Tag
Update-MgDeviceManagementWindowsAutopilotDeviceIdentityDeviceProperty `
    -WindowsAutopilotDeviceIdentityId $device.Id `
    -GroupTag "Corp-Win11-Finance"

Write-Host "Group Tag updated. Allow 5-10 minutes for Entra ID dynamic group membership to recalculate."

Group Policy — What Applies Here (and What Does Not)

What GPO can affect post-Autopilot:

• Device naming conventions — enforced via Autopilot device name template in the deployment profile (Intune), not GPO
• Windows Update for Business deferral — can be set via GPO at Computer Configuration > Administrative Templates > Windows Components > Windows Update > Windows Update for Business, but Intune Update Rings take precedence on Entra joined devices
• Scripts run post-enrollment — Intune PowerShell scripts (System context) apply during/after OOBE; GPO startup scripts apply only after the device is domain-joined (hybrid only)

Verifying the Device Appears in Autopilot Diagnostics

On the device itself, you can confirm Autopilot registration by checking the MDM diagnostics. Open PowerShell as Administrator and run:

# Export MDM diagnostics including Autopilot data
MdmDiagnosticsTool.exe -area DeviceEnrollment;Autopilot -zip C:\Temp\AutopilotDiag.zip

Inside the ZIP, open AutopilotDDSZTDFile.json. The ZtdDeviceIdentifier value is the hardware hash identifier. If this file is present and populated, the device has a valid hash. If it is empty or missing, the hash was never captured — which means re-running the hardware hash capture script is the fix.

References

• Get-MgDeviceManagementWindowsAutopilotDeviceIdentity — Microsoft Learn
• List windowsAutopilotDeviceIdentities (Graph API) — Microsoft Learn
• Windows Autopilot overview — Microsoft Learn
• Troubleshoot Windows Autopilot device enrollment — Microsoft Learn
• Use the $filter query parameter — Microsoft Graph — Microsoft Learn
• Get started with the Microsoft Graph PowerShell SDK — Microsoft Learn