Intune runs the device. We get the device to Intune.
Intune isn't a competitor — it's the destination. Its job starts the moment a device is enrolled. Everything before that, from a blank disk to a machine Autopilot recognises, is still manual work. That's the gap StageReady closes.
Four things Intune can't do yet, because the device isn't there yet
None of this is a knock on Intune. It's what sits between an unboxed laptop and the first moment Intune has anything to manage.
Something still has to install Windows
Intune has no OS or disk imaging. Autopilot provisions a device that already has Windows on it. A blank disk, a wiped machine, or a returned laptop means a technician standing there with a USB stick and an ISO before Intune is even in the picture.
Autopilot has to know the device already
Classic Autopilot needs each device's hardware hash: boot the machine, run the script, export a CSV, import it. Registration through the OEM or CSP channel avoids that — but only for hardware bought that way. Off-the-shelf, refurbished and returned stock falls back to doing it by hand.
Firmware is largely out of reach
Intune's BIOS configuration profile currently supports Dell only, and only once the device is enrolled with the OEM's agent app deployed. DFCI covers Surface, Acer, Asus, Dynabook, Fujitsu and Panasonic — not HP, not Lenovo. StageReady applies HP and Dell BIOS settings in WinPE, before Windows installs.
Nothing runs before enrollment
Every Intune policy, script and app waits for the device to be enrolled. The work that is cheapest to do before that — driver packs, region and keyboard baked into OOBE, the computer name, a local admin, a machine certificate, defaults for every new user — is all day-zero work.
Where each one starts and stops
| Dimension | StageReady | Microsoft Intune |
|---|---|---|
| Starting point | A blank disk — or a device that already has Windows on it | A device already running Windows |
| Installing Windows | Installs Windows 11 from bare metal, with the right OEM driver pack injected | No OS or disk imaging — Autopilot provisions a device that already has Windows installed |
| Autopilot registration | Captures the hardware hash and registers the device through Graph, during the build | The hash has to reach Intune first: capture it per device and import a CSV, or register through the OEM / CSP channel |
| Hybrid and domain-joined clients | Domain join is a step like any other, and runs independently of Autopilot registration | Autopilot device preparation (v2) is Microsoft Entra join only — hybrid join still needs classic Autopilot, and classic Autopilot still needs the hash |
| BIOS & OEM firmware | HP and Dell BIOS settings applied in WinPE, before Windows installs — Secure Boot, TPM, boot order, and more | The BIOS configuration profile currently supports Dell only, and needs the device already enrolled with the OEM's agent app deployed first |
| Apps before first sign-in | Installed machine-wide, as SYSTEM, while Windows is still setting itself up | Nothing installs until the device is enrolled and the Intune Management Extension arrives |
| App packaging | Picked from a catalogue; MSI/EXE downloaded from the vendor's own URL and signature-verified | Win32 apps are repackaged into .intunewin with the Content Prep Tool and uploaded — per tenant |
| How many apps during setup | A whole list, each with its own timeout; one app failing doesn't stop the rest | Device preparation allows up to 10 apps and 10 scripts; the classic Enrollment Status Page has a blocking-app list and a timeout |
| Across many client tenants | One template, then a profile per client that layers add-on templates, sets that client's own values, and inherits from a parent — children store only the differences | Policies, apps and profiles are configured in each tenant |
| Licensing | No client licence needed unless the profile enrolls the device into Microsoft | Requires an Intune licence per user |
| Ongoing management | Not its job | A core strength — policy, patching, compliance, reporting |
It's a question of when, not whether
Intune installs applications well. What it can't do is install them before the device is enrolled — and on a fresh build, that's the window that matters.
StageReady
- MSI/EXE straight from the vendor's official URL, Authenticode-verified — nothing re-hosted
- Installed machine-wide, as SYSTEM, while Windows is still setting itself up
- No repackaging, no upload, no per-tenant work — one catalogue serves every client
- Each app has its own timeout; one bad download doesn't sink the build
Microsoft Intune
- Per-user apps, Microsoft Store and MSIX packages
- Ongoing updates, supersedence, uninstall
- Compliance and installation reporting across the fleet
- This is Intune's ground, and we don't try to take it
Both draw the same line
- Installers with no unattended mode at all
- Intune states plainly that it doesn't support interactive installations
- Nor do we — setup runs with no screen and nobody to click a wizard
- An installer that only works through its wizard has to be repackaged first
Provision with StageReady, manage with Intune
A device flows from one to the other: StageReady takes it from a blank disk to registered in the client's Autopilot, then Intune manages it for the rest of its life. We make Autopilot fire more often — including on hybrid-joined clients and hardware that never came through the CSP channel.
Day zero
StageReady builds & registers
Day two
Intune enrolls & manages
StageReady and Microsoft Intune
Sources
Intune and Autopilot behaviour described on this page, as documented by Microsoft. Products change — if something here has moved on, tell us and we'll correct it.
- Win32 app management in Microsoft Intune
- Update Windows BIOS using configuration MDM policy
- Windows Autopilot device preparation requirements
- Create a Windows Autopilot device preparation policy
- Windows Autopilot registration overview
- Reseller, distributor, or partner registration of Autopilot devices
- Troubleshoot the Enrollment Status Page