A laptop dies. You delete it from Entra ID because that felt like the obvious "remove this device" button. Three weeks later a replacement device with the same serial number refuses to enrol through Autopilot, the record is stuck, and Microsoft support asks you exactly which order you did things in. There is a correct order. Most people never learn it because it never comes up — until the one time it does.
This post walks through what Windows Autopilot registration actually is, why deregistering a device is a three-system operation rather than a single delete button, and gives you a PowerShell script that checks a device's real status across Autopilot, Intune, and Entra ID in one call — so you know exactly what state a device is in before you touch anything.
The problem — deleting the wrong thing first can leave a device permanently stuck
Windows Autopilot registration is not one action. It is two separate things that both have to be true at once:
- The device's unique hardware identity — its hardware hash — has been captured and uploaded to the Windows Autopilot service.
- That hardware hash has been associated with your organisation's Entra tenant ID.
When a device registers successfully, Windows Autopilot automatically creates a Microsoft Entra device object for it. The Autopilot deployment process needs that object to identify the device before anyone signs in. This is the part that catches people out: if you delete the Entra device object manually, out of order, the device can end up in a state where Windows Autopilot can no longer recognise it, but the old registration hasn't been cleanly removed either. Support calls this an unrecoverable device state, and it is exactly as unpleasant to fix as it sounds.
Why it happens — three systems, one device, and no single "delete" button that covers all of them
A registered Autopilot device touches three separate systems, and each one needs to be handled in the right order:
- Windows Autopilot deployment service — holds the hardware hash registration and Group Tag.
- Microsoft Intune — holds the managed device record once the device has enrolled.
- Microsoft Entra ID — holds the device object that Autopilot's identification step depends on.
These three records are linked, but deleting one does not automatically clean up the others in a predictable way. Microsoft's own documentation is explicit that the correct order is Intune first, then Autopilot — never Entra ID directly, and never Autopilot before Intune.
There is also a portal-level gotcha that trips up a lot of admins the first time they go looking for a device. In the Intune admin center, Devices > Windows > Windows devices is not the same list as Devices > Enrollment > Windows > Windows Autopilot > Devices. A device only appears in the first list once both the Autopilot registration succeeded and a licensed user has actually signed in on it. If you're looking for a device that's registered but has never been through Out-of-Box Experience, you won't find it in "Windows devices" at all.
How to verify — check what state a device is actually in before you touch anything
Before deregistering, deleting, or troubleshooting a device, confirm its current state across all three systems. Don't assume — a device that looks "stuck" in one portal might already be perfectly healthy in another.
$filter on serial number has historically been unreliable for some tenants and API versions — an exact-match filter can return a BadRequest error even with correct syntax. If that happens, pull the full device list with -All and filter client-side in PowerShell instead. The full script below does this defensively so you don't hit the same wall.The fix — the correct deregistration order, step by step
This is the exact sequence Microsoft documents for permanently removing a device — for example, one that's been retired, sent for repair and replaced, or reached end of life.
Step 1 — Delete the device from Intune first
- Sign in to the Microsoft Intune admin center.
- Select Devices in the left pane.
- Under By platform, select Windows.
- Find the device under Device name and select it.
- Note the serial number shown on the device properties page — you'll need it in Step 2.
- Select Delete in the toolbar.
- Confirm the deletion when the warning dialog appears.
Step 2 — Deregister the device from Windows Autopilot
- Confirm the device is already deleted from Intune (Step 1).
- Go to Devices > Windows > Windows devices, then under Device onboarding select Enrollment.
- Under Windows Autopilot, select Devices.
- Find the device by its serial number using Search by serial number.
- Select the device's checkbox, then the … menu on that row.
- If Unassign user is available (not greyed out), select it and confirm.
- With the device still selected, select Delete in the toolbar and confirm.
- Select Sync to accelerate the deregistration, then Refresh every few minutes until the device disappears from the list.
What to do afterwards, depending on join type
| Join type | Extra step needed |
|---|---|
| Microsoft Entra joined | None. Do not manually delete the device from Entra ID. |
| Microsoft Entra hybrid joined | Delete the computer object from on-premises Active Directory to stop it re-syncing to Entra ID. No further Intune or Autopilot action needed. |
Other portals that can deregister a device
Two other portals can also deregister a device from Windows Autopilot, but neither performs the full cleanup:
- Microsoft 365 admin center —
Devices > Autopilot > Delete device. - Microsoft Partner Center (MPC) — for a Cloud Solution Partner:
Customer > Devices > Delete device.
Proof it worked — confirm the outcome across all three systems, not just one
Microsoft's documentation is specific about one thing people get wrong after deregistering: the Entra device object's fate depends on whether the device was ever enrolled in MDM.
| Device history | What happens to the Entra device object |
|---|---|
| Never enrolled in MDM | Removing the Autopilot registration can also remove the Entra device object. |
| Is or was enrolled in MDM | The Entra device object is not automatically deleted — it can remain even though Autopilot registration is gone. |
This is exactly why "it's gone from the Autopilot list" isn't proof that cleanup is complete. Run the check below both before and after deregistering, so you have a real before/after comparison instead of assuming.
Get-AutopilotDeviceRegistrationStatus.ps1 is free and open source. It checks Autopilot registration, Intune enrollment, and the Entra device object for one serial number, in a single read-only call.