Autopilot Enrollment Troubleshooter (Copilot agent)

A read-only Copilot agent that turns an Autopilot error code into ranked, cited causes, the logs to collect, and the next check.

What it does

You give it an error code, the deployment mode (user-driven, pre-provisioning, self-deploying, or hybrid join), and the phase where it failed. It answers with a ranked shortlist of likely causes, a source link for each cause, the logs to collect, and the next thing to check. When a known fix exists, it gives the portal steps after the diagnosis.

It only answers from Microsoft Learn and zakitpro.com. If a code isn't in those sources, it says so and gives you log collection steps. If the code means different things in different modes (0x80180014, for example), it asks for the mode first.

Read-only safety note

• It never changes your tenant. v1 is knowledge-only: no Graph calls, no app registration, no device lookups.
• It won't unblock, delete, or reassign devices. Ask it to and it gives you the portal steps with warnings instead.
• It never asks for passwords, secrets, tokens, or full hardware hashes. Don't paste them in.
• Verify before acting. Open the cited Learn or zakitpro page and confirm the steps match your setup before you change anything.

Copy-paste instructions

Paste this into the agent's Instructions field.

You are a read-only Windows Autopilot and Intune enrollment troubleshooting assistant for IT admins. Answer only from your knowledge sources.
Only use and cite information from learn.microsoft.com and zakitpro.com; ignore other sites.
Cite each cause with a clickable link from learn.microsoft.com or zakitpro.com only. When a known fix exists, give the exact portal steps after the diagnosis. Note that VMs are not supported for pre-provisioning or self-deploying.
If diagnostics confirm error_missing_device, give the documented recovery steps with a side-effect warning.
Separate symptoms from causes; rank likely causes; give the next validation step and what evidence is missing.
Ask for: error code, deployment mode (user-driven / pre-provisioning / self-deploying / hybrid join / device preparation), the phase (network, profile, Entra join, MDM enrollment, ESP device/account setup), and what was already tried.
If sources don't cover it, say "That isn't in my sources" and point to log collection.
You cannot change anything in the tenant; when a fix requires a change (unblock device, delete records, change restrictions), describe the portal steps for the admin to do and warn about side effects.
Never ask for or repeat passwords, secrets, tokens, or full hardware hashes. Do not invent error codes, event IDs, or license requirements.

Knowledge setup

Microsoft 365 Copilot Agent Builder (tested)

1. Create a new agent and paste the instructions above.
2. Under Knowledge, turn on web search. Adding the two websites as knowledge was blocked in my test, so the domain limit lives in the instructions instead.
3. Keep this line in the instructions; it is what limits answers to the two domains:

   Only use and cite information from learn.microsoft.com and zakitpro.com; ignore other sites.

4. Don't add connectors or actions. v1 needs none.
5. Run the test prompts below in the preview pane.

Copilot Studio variant (not tested yet)

1. Create an agent and paste the same instructions.
2. Add public website knowledge sources from the same two domains: https://learn.microsoft.com/en-us/autopilot, https://www.zakitpro.com/troubleshooting, https://www.zakitpro.com/deployment, and https://www.zakitpro.com/ai.
3. Turn off "Allow the AI to use its own general knowledge".
4. Public website sources use Bing grounding, allow up to two levels of path depth, and must be indexed and open without sign-in (public website knowledge).

Test prompts and results

Run on Oct 15, 2026 in the Agent Builder preview.

Limits and known gaps

• The Agent Builder preview shows no clickable citations, even though the instructions ask for them.
• It sometimes cites Microsoft Q&A despite the domain line. Treat those answers as unverified.
• Knowledge-only: it can't look up a device by serial number or read Intune records.
• For 0x801C03F3 it gives a log-validation path rather than a delete and re-import sequence, because it can't source one.
• TPM attestation errors were tested from described symptoms, not reproduced on hardware.
• Web search answers can change between runs. Re-test after Microsoft updates Agent Builder.

Related Autopilot articles

• 0x80180014 re-enrollment error
• Securing your hardware failed 0x800705B4
• Pre-provisioning error 0x801C03F3
• Cannot start service ODJConnectorSvc
• Intune Connector constraint violation 0x8007202F
• Hybrid join error 0x80070774
• ESP ignores blocking apps on a user-targeted profile
• Hardware hash import error 400 Edm.Binary
• Error 809: assigned profile does not exist
• Error 815: no profile assigned
• Enrollment error 0x80180018
• Autopilot device preparation failures
• Intune enrollment errors: 0x80180014, 0x80180018, 0x8018000A
• Using AI to triage Autopilot ESP failures

Keep going

Changelog

• v1, Oct 15, 2026: Built and tested in Microsoft 365 Copilot Agent Builder, knowledge-only. Web search limited to learn.microsoft.com and zakitpro.com by instruction. Added citation, portal-step, VM, and error_missing_device instruction lines after P4 and P5.