> For the complete documentation index, see [llms.txt](https://docs.foundryosd.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.foundryosd.com/foundry-osd/autopilot/zero-touch-hardware-hash.md).
# Zero-touch hardware hash upload
**Zero-touch hardware hash upload** registers each device in Windows Autopilot during the deployment, with nobody signing in on the device. The deployment media carries a certificate that lets Foundry Deploy upload the hardware hash to your tenant.
The tenant and certificate identifiers are hidden in this picture.
## Before you start
* **An account for the sign-in on the PC.** With it, Foundry OSD creates an app registration and an enterprise application in your tenant and grants admin consent for one permission. Check with your tenant administrator which account may do this: the permissions the sign-in asks for are listed under [Windows Autopilot credentials](/reference/security-and-credentials.md#windows-autopilot-credentials).
* **The Deployment Tools of the Windows ADK.** Media creation takes `oa3tool.exe` from them. See [ADK](/foundry-osd/adk.md).
* **A safe place for the certificate file and its password**, such as a password vault.
* **Password protection, recommended.** This mode works without it, but anyone who holds the media can then use the certificate it carries. See [Password protection](/foundry-osd/general.md#password-protection).
* **Network in Windows PE** to the Microsoft sign-in and Microsoft Graph hosts of [Network endpoints](/reference/network-endpoints.md).
## Configure zero-touch upload
1. Open **Windows Autopilot > Zero-Touch** and select **Enable**.
2. Select **Connect tenant** and complete the sign-in in the browser. Foundry OSD asks nothing else: it finds or creates the app registration `Foundry OSD Autopilot Registration` in your tenant and gives it one Microsoft Graph application permission, `DeviceManagementServiceConfig.ReadWrite.All`.
3. Under **Provisioned certificates**, select **Create certificate**, choose a validity of 1, 3, 6 or 12 months in the menu, then choose where to save the `.pfx` file.
4. In the **Certificate ready** dialog, store the **PFX file** and the **PFX password** in your safe place before you close it. **Copy password** copies the password.
5. Check that **Status** reads **Ready** in **Tenant readiness** and that **Boot media certificate** reads "Certificate ready for boot media generation." The new certificate is selected for you.
6. In **Default group tag**, choose the tag that Foundry Deploy preselects, or keep **None**.
7. Create or update the deployment media from [Start](/foundry-osd/media.md).
{% hint style="warning" %}
Store the password while the **Certificate ready** dialog shows it. Foundry OSD also remembers it on this PC, encrypted for your Windows account; it leaves this PC only in an export or a publication with **Include passwords**. See [Saved passwords and files](/foundry-osd/configuration-sharing/saved-passwords.md). If you lose it, remove the certificate and create another one.
{% endhint %}
**Tenant readiness** has four rows:
| Row | Shows |
| ---------------------------- | ----------------------------------------------------------------------------------------------------------------- |
| **Managed app registration** | "Foundry OSD Autopilot Registration is configured." |
| **Tenant ID** | The tenant you signed in to |
| **Client ID** | The application ID of the app registration |
| **Status** | **Ready**, or **Not ready** while the app registration has no valid certificate or another requirement is missing |
A permission, consent or enterprise application problem has no row of its own: a dialog titled **Tenant onboarding requires attention** names it after the sign-in.
## If the certificate is no longer selected
Foundry OSD keeps the tenant, the app registration and the default group tag. It also saves a copy of the PFX and its password for your Windows account, so the certificate is still selected when you start the app again: see [Saved passwords and files](/foundry-osd/configuration-sharing/saved-passwords.md).
The certificate is no longer selected after **Disconnect tenant**. Then open **Windows Autopilot > Zero-Touch**, select **Select PFX**, choose the file and type **PFX password**. You do not sign in again while the certificate is valid. In a configuration imported or followed without its passwords, only **PFX password** is empty: type it.
Renew, remove or bring your own certificate
These actions need a connected page: the button of **Tenant connection** reads **Disconnect tenant** when it is. Otherwise select **Connect tenant**.
**Renew.** A certificate cannot be extended. Before it expires, create a new certificate, then create or update every media that must keep uploading.
**Remove.** To withdraw a certificate, for example after losing media, select its row in **Provisioned certificates**, then **Remove certificate**, and confirm. Media built with a removed or expired certificate no longer uploads; the deployment itself still completes.
**Bring your own certificate.**
1. Do steps 1 and 2 of the procedure above so that the app registration exists.
2. In the Microsoft Entra admin center, upload the public certificate (`.cer`, `.pem` or `.crt`) to the app registration `Foundry OSD Autopilot Registration`, with exactly `Foundry OSD Autopilot Registration` as its description. Foundry lists only certificates with this description. See [Add and manage application credentials in Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity-platform/how-to-add-credentials).
3. In Foundry OSD, reconnect: select **Disconnect tenant** if the page is connected, then **Connect tenant**. The certificate appears in **Provisioned certificates**.
4. Select **Select PFX**, choose the password-protected PFX that holds the private key and type **PFX password**.
Foundry checks that the PFX opens with the password, contains a private key, has not expired and matches a listed certificate. Never upload the PFX itself to Microsoft Entra.
## What the technician sees
Foundry Deploy shows an **Autopilot** step where the technician can change the group tag. The upload runs near the end of the deployment, in the step **Register Autopilot device**, and waits up to 10 minutes for the device to appear in your tenant. Most failures of the hardware hash capture or upload only skip that step, and the deployment still completes. Three capture failures, about a Windows file named `PCPKsp.dll` that is missing or unusable, stop the deployment. See [Windows Autopilot step](/foundry-deploy/autopilot.md).
## Check the result
* On **Start**, the **Zero-Touch** row of the **Windows Autopilot** card reads "Enabled: zero-touch hardware hash upload".
* After a deployment, find the device by its serial number among the Windows Autopilot devices of your tenant, with its group tag. Foundry waits for the device to be listed, not for a profile to be assigned to it.
## Limits
* **Group tags come from the tenant.** The lists in Foundry OSD and Foundry Deploy hold only tags already carried by a Windows Autopilot device of your tenant. Nobody can type a new tag in this mode.
* **None clears a tag.** A device already registered with a group tag loses it when it is deployed with **None**.
* **An existing registration keeps its hash.** For a serial number that is already registered, Foundry updates the group tag and the name, not the stored hardware hash. After a motherboard replacement, delete the old registration first: see [Windows Autopilot motherboard replacement](https://learn.microsoft.com/en-us/autopilot/autopilot-motherboard-replacement).
* **The hardware hash stays on the device** after the deployment, in the folder described under [Evidence files](/troubleshooting/autopilot/during-deployment.md#evidence-files).
* To send the computer name as well, turn on **Upload computer name to Autopilot** on [Machine naming](/foundry-osd/customization/machine-naming.md).
## Related
* [Windows Autopilot step](/foundry-deploy/autopilot.md)
* [Windows Autopilot](/foundry-osd/autopilot.md), for the rules shared by the three modes
* [Security and credentials](/reference/security-and-credentials.md)
* [Windows Autopilot troubleshooting](/troubleshooting/autopilot.md)
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.
Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:
```
GET https://docs.foundryosd.com/foundry-osd/autopilot/zero-touch-hardware-hash.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.
