Device settings and commands reference
Administrators do not use the Autopilot interface on the device. Everything is driven from the control panel: settings describe how a device should be configured, and commands tell it to do something now.
This page is a map of both. It groups them by the job they do rather than listing field names, because the names alone rarely make the purpose obvious.
Two scopes, applied together
Section titled “Two scopes, applied together”Settings arrive from two places:
| Scope | Covers |
|---|---|
| Organization | Policy that should be the same across the customer — application-update behaviour, migration tenant configuration, and similar org-wide choices |
| Device | State and configuration belonging to one machine — its Microsoft 365 install state, its migration status |
Changing organization settings raises a command to every affected device, so the change propagates without waiting for the next scheduled check-in.
What you can configure
Section titled “What you can configure”Roughly eighty settings are held per device. Grouped by purpose:
Identity and directory
Section titled “Identity and directory”Active Directory synchronization (including whether LDAPS is required) and the credentials it uses; the account behind a userless installation; local administrator account management and password renewal.
Remote access and support
Section titled “Remote access and support”ScreenConnect integration — whether it is enabled, the client and group names it registers under, and when installation was last attempted. Sending diagnostic logs is a command rather than a setting.
User environment
Section titled “User environment”Drive mapping and the provider behind it; RemoteApp publishing, including which certificate thumbprints are trusted for published connections; Outlook signatures, the signature prefix, and whether roaming signatures are suppressed; screen-saver policy; automatic proxy detection.
Updates and software
Section titled “Updates and software”Agent auto-update; WSUS server selection and its certificate; Microsoft 365 installation; Windows Update health — current status, last check, whether remediation has been attempted, the last error, which updates last failed, and whether a reboot is pending. There is also a record of when the update service-level notification was last shown to the user, so the same prompt is not repeated endlessly.
Power management
Section titled “Power management”Sleep and display timeouts, set independently for mains and battery, each with its own enable flag. A timeout value only takes effect if its flag is on.
Security and compliance
Section titled “Security and compliance”BitLocker recovery-key escrow — a hash of the documented key and when it last synchronized; Intune device-ownership classification; Windows 11 compatibility; Windows Autopilot registration state.
Monitoring and telemetry
Section titled “Monitoring and telemetry”Log Analytics workspace and key, plus the data collection rule identifiers used to associate the device; telemetry enablement and batch size; digital-employee-experience sync timing; geolocation; warranty lookup; the device’s external IPv4 and IPv6 addresses.
Backup
Section titled “Backup”Veeam connection details, last backup timestamp, and the separate Veeam for Microsoft 365 credentials and sync state.
What you can instruct
Section titled “What you can instruct”Thirty-seven commands can be issued to a device. They are queued and executed by the agent’s system service.
Device lifecycle
Section titled “Device lifecycle”| Command | Effect |
|---|---|
| Reboot device | Restarts the machine |
| Set machine name | Renames the device |
| Delete device | Removes the device record |
| Update agent | Installs a newer agent build |
| Repair settings | Reapplies the organization’s default configuration |
| Send logs | Uploads agent diagnostics for support |
Windows updates
Section titled “Windows updates”| Command | Effect |
|---|---|
| Install updates | Starts a Windows Update installation |
| Hide Windows update | Suppresses a specific update |
| Remediate Windows update | Attempts repair when the update stack is unhealthy |
| Notify missing updates | Raises the Updates Required prompt on the device |
Software
Section titled “Software”Run winget updates updates installed applications through Windows Package Manager. Run Windows disk cleanup reclaims space — useful ahead of a migration, which requires free disk space to pass preflight.
Security and access
Section titled “Security and access”Renew local admin password rotates the managed local administrator credential. Reset AIP settings clears Azure Information Protection state. Set firewall status controls the Windows firewall. Reinstall ScreenConnect client repairs remote-access connectivity. Change credentials updates the stored user credential.
Directory and local accounts
Section titled “Directory and local accounts”Active Directory: create, delete and synchronize a user, and synchronize a user’s password.
Local accounts: update, delete or reset the password of a local user; create, update or delete a local group, and add or remove a user from one.
Configuration pushes
Section titled “Configuration pushes”Set AD sync settings, set power settings, set Veeam settings, set Veeam for Microsoft 365 settings, and organization device settings changed — the last is raised automatically when you change organization-level settings, rather than issued by hand.
Migration and provisioning
Section titled “Migration and provisioning”Sync migration settings drives the Entra ID migration flow. Provisioning (IoT) and userless registered relate to device enrolment and are issued by the platform rather than by an administrator.
Knowing whether a command worked
Section titled “Knowing whether a command worked”Commands are queued, not synchronous. A device that is asleep, offline or mid-restart picks its commands up when it next connects — so “nothing happened yet” is the expected state for a short period, not a failure.
Some commands are explicitly long-running and are not expected to complete quickly. Installing updates and running application updates both fall into this group.
To confirm an outcome, look at what the command was supposed to change rather than at the command itself: the device’s reported Windows Update health after an update install, the last backup timestamp after a Veeam change, the agent version after an update. If a device stops reporting altogether after a command, treat that as the failure signal.
Related
Section titled “Related”- Deploying the Autopilot agent at scale
- Entra ID tenant-to-tenant migration
- The Autopilot icon on your computer — what the user sees when a command prompts them
