Building a Task Sequence
A Task Sequence is the ordered list of steps a deployment runs. Left navigation → Task Sequences → New.
Anatomy
A typical sequence looks like this:
WinPE phase
- Disk Preparation - wipes and partitions the disk (GPT/UEFI).
- Apply WIM - downloads and applies your OS image.
- Inject Drivers - matches and injects driver packs (see Adding Driver Packs).
- Configure Boot - writes the boot files.
- Apply Unattend - applies the answer file (computer name, locale, and the local admin account used at first boot).
First-boot phase
- Common Tweaks - baseline OS tweaks / hardening.
- Install Applications - installs your selected apps.
- Install Microsoft Office - (optional) Office via the Office Deployment Tool.
- Registry Settings - applies registry keys.
- Entra ID Join + Intune - joins Entra ID and enrols in Intune (see Entra ID / Autopilot enrolment).
Sequence settings (set once per sequence)
- Local admin username / password - the account created on the device (default username
CloudAdmin). Set a password - the first-boot progress screen signs in with this account, so without it there's no first-boot UI. - End action - what the device does after the WinPE phase:
- OOBE (default) - reboots to the Windows out-of-box experience (required for Autopilot).
- Reboot - restarts to the local-admin sign-in.
- Sign off - sign out only (for testing).
Sequences are versioned - editing creates a new version. A sequence's deploy count only increases on successful deployments.
Step reference
| Step | Phase | What it does | Key options |
|---|---|---|---|
| Disk Preparation | WinPE | Wipes and partitions the target disk. | Disk number (default 0), GPT/UEFI or MBR/BIOS, wipe on/off |
| Apply WIM | WinPE | Applies the chosen OS image to the disk. | OS image, image index |
| Inject Drivers | WinPE | Injects packs matching the device, or the specific packs you tick. | Driver packs (empty = auto-match) |
| Configure Boot | WinPE | Writes the boot files / BCD so the new OS boots. | Boot drive, UEFI/BIOS |
| Apply Unattend | WinPE | Generates the unattend answer file. | Uses sequence-level local admin username/password |
| Common Tweaks | First-boot | Applies a checklist of Windows tweaks / hardening (see below). | ~16 toggles |
| Install Applications | First-boot | Downloads and silently installs the selected apps. | Apps from Content Library |
| Install Microsoft Office | First-boot | Installs Microsoft 365 / Office via the Office Deployment Tool. | Edition, channel, product, languages, exclusions, shared-computer licensing |
| Registry Settings | First-boot | Applies a group of registry entries. | Hive, key, name, type, value |
| Run PowerShell | First-boot | Runs a PowerShell script (inline or uploaded). | Timeout, success codes, run as SYSTEM or user |
| Run Command | First-boot | Runs a single command line. | Command, timeout, success codes |
| Entra ID Join + Intune | First-boot | Joins Entra ID / enrols in Intune (Autopilot or PPKG). | Method, group tag, assigned user, PPKG |
| Reboot | Either | A real restart during first-boot (WinPE reboot happens automatically anyway). | Delay, resume-after-reboot |
Variable tokens
Available in Run PowerShell and Run Command steps: {computerName}, {tenantName}, {deploymentId}.
Common Tweaks toggles
The Common Tweaks step exposes on/off switches, including: show This PC in Explorer, show file extensions, show hidden files, dark mode, remove consumer bloat (Candy Crush etc.), disable Widgets, disable Teams Chat, disable Recall, disable Copilot, disable Cortana, disable lock-screen ads, disable News & Interests, disable Edge first-run, enable RDP, never sleep on AC power, and force TLS 1.2.