Windows Autopilot device association is the native name template Autopilot device preparation never had. A lot of shops already use device prep as the main path: no hardware hash, user signs in at OOBE, Intune takes over, then a script fixes DESKTOP-XXXXXX. Microsoft’s August 27 announcement is for those shops. It is not a reason to rip out Autopilot v1.
What’s changing
Device association binds a physical Windows 11 PC to the tenant before enrollment. TPM attestation proves the box, then a tenant-affinity marker is written into UEFI. After that, a device preparation policy can name the PC, set language, skip EULA and privacy pages, and mark the device corporate-owned without a separate corporate identifier. Maggie Dakeva’s Intune Customer Success post is the announcement. Microsoft Learn is the how-to.
The current Intune path is still hands-on. At OOBE, tap the Windows key five times, export a DeviceLink CSV to USB (NTFS recommended), then upload it under Devices > Enrollment > Device association > Devices. One device per CSV. The OOBE menu also shows a QR code. Intune does not accept it. QR is for a custom Graph app. Existing devices that already passed OOBE pull DeviceLink from Autopilot diagnostic logs instead of the menu.
OS gate: Windows 11 24H2 or 25H2 with KB5120998 or later. That KB is the August 27 preview cumulative (builds 26100.9278 / 26200.9278), not the August 11 security update. Physical TPM 2.0, healthy, not in Reduced Functionality Mode. No VMs. No Windows 365. Name template: up to 63 characters, letters, numbers, hyphens, %SERIAL% or %RAND:x%, plus a literal prefix. Username, site, or a CMDB asset tag are not in the template language.
Why operators should care
Post-enroll rename scripts work. They are also late. The Entra device object, the Intune record, BitLocker, and anything keyed off hostname often get created as the OEM name first. Then the script races the rest of policy. Autopilot v1 never had that ticket. Device association is the AP-DP version of tenant context during OOBE, which is why Rudy Ooms spent a year documenting it: device prep starts after sign-in, so naming had nowhere to land.
The tax, for a shop already on user-driven device prep, is a pre-step you may not do today. Association adds export-and-upload. Device assignment beats user assignment when both exist. If you associate a leftover classic Autopilot device, device preparation wins. The UEFI marker survives wipe, reinstall, and unenrollment. Deleting the Intune record does not clear it. For an Associated device you need physical access, the PowerShell UEFI module, and you clear DeviceLinkId, DeviceLinkBlob, and DeviceLinkUtc. Unenroll first or Intune puts it back. Extra firewall: ztd.dds.microsoft.com and a pile of peapdamaa*.attest.azure.net URLs on 443.
KB5120998 is a preview CU. Do not assume every 24H2 box in the field can associate this week.
The missed signal
Community reaction is not a fleet cutover. Lewis Barry’s July 2026 take still holds for shops with working OEM hash upload: stay on Autopilot v1. The people who should care this week are already on device prep, staring at a rename script. Call4Cloud commenters said the CSV is not much better than collecting a hash or a corporate identifier, and they want an Apple Configurator-style app that scans the QR. Microsoft’s FAQ still says uploads are Intune-only. OEM and partner pre-association is later. Michael Niehaus spotted the unfinished Canary UI in 2024. What shipped is that idea, minus the factory path.
What to do next
Map the current rename script to the template. Prefix plus serial or random digits: association can retire the script. Anything else: keep the script. Pilot two or three physical 24H2/25H2 devices with KB5120998 and a healthy TPM. Confirm the Entra and Intune objects are born with the templated name. Time the USB export on a real bench. Write the UEFI wipe into offboarding before the first production association. Keep Autopilot-registered devices out of the association blade unless that box is intentionally moving to device preparation. Add the attestation endpoints before the first field unit.
