Topic starter
23/10/2026 12:45 am
TL;DR: Zero-touch Windows deployment can work without Autopilot because provisioning packages can enroll new devices from first setup, according to Fleet. Windows onboarding now hinges on custody, rotation, and revocation of the package secret, not just on shipping speed.
Editorial analysis by NHI Mgmt Group, based on content published by Fleet: “Autopilot without Autopilot: zero-touch Windows deployment with Fleet”.
By the numbers:
- At Microsoft's list price, that's $84 per person per year that this approach doesn't require.
- For a 500-person company, it's $42,000 a year, spent so that devices can enroll.
Key questions
Q: Why do device staging workflows need secrets management as well as endpoint management?
A: Because the package that automates enrollment is itself a credential-bearing artifact.
Q: How can security teams tell whether zero-touch Windows onboarding is under control?
A: Look for separated staging paths, unique enroll secrets per path, and evidence that compromised or old packages can be revoked without affecting active fleets.
Q: What breaks when a Windows provisioning package is used without secret governance?
A: The deployment still works technically, but the trust model fails if the package secret is shared too broadly or reused too long.
Practitioner guidance
- Define who can create enrolment packages Restrict package creation to a small operational group and treat the resulting .ppkg file as a privileged onboarding artifact.
- Use separate enroll secrets for each fulfilment path Issue distinct secrets for partner staging and in-house imaging so one compromised package does not affect every onboarding route.
- Rotate package secrets on handoff or suspicion Replace the secret immediately if a package leaves controlled custody, and retire old secrets before the next shipping cycle.
Bottom line: Zero-touch Windows deployment can work without Autopilot, but the trade-off is that the onboarding package becomes a privileged credential-bearing artifact.
Glossary terms: Provisioning Package, Enroll Secret, Zero-Touch Deployment, MDM Enrollment
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
Enrollment secrets are the hidden NHI in device staging: once the package carries a reusable secret, the onboarding flow stops being a pure endpoint problem and becomes a machine-identity governance problem. The article shows that zero-touch Windows deployment can bypass Entra-based identity checks, which means the secret itself becomes the trust anchor. Practitioners should govern package secrets like any other NHI credential.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: When is Autopilot still the better choice than a provisioning package approach?
A: Autopilot remains the better fit when you want Entra-joined devices and already pay for the Microsoft identity stack underneath it. The provisioned-package model is useful when you want zero touch without that per-user cost, but it does not give the same identity-driven enrollment boundary.
👉 Read our full editorial: Zero-touch Windows deployment without Autopilot’s Entra tax
This post was modified 6 days ago by NHI Mgmt Group