1. Start with the exact schema
For an administrator importing hardware hashes directly into Intune, the serial number and hardware hash are the required identity fields. Windows product ID is optional for this path. Group tag and assigned user are optional operational fields.
Device Serial Number,Windows Product ID,Hardware Hash,Group Tag,Assigned User
SERIAL123,,BASE64_HARDWARE_HASH,Chicago-Laptops,user@contoso.comDo not casually rename those columns. Microsoft documents the headers as case-sensitive. Extra columns and quotation marks are not accepted. If you do not need an optional value, keep its position and leave the field empty rather than changing the shape of the row.
| Column | Direct Intune import | Preflight check |
|---|---|---|
| Device Serial Number | Required | Present, not whitespace, and matches the device or source record. |
| Windows Product ID | Optional | Leave blank when it is not part of your collection path; do not remove the column. |
| Hardware Hash | Required | Present as one uninterrupted value and not shortened by a spreadsheet display or copy operation. |
| Group Tag | Optional | Matches the exact value your dynamic group or operational process expects. |
| Assigned User | Optional | Uses an intended, valid UPN. Avoid assignment when the deployment model does not require it. |
2. Treat encoding as part of the data
A CSV can look correct in a spreadsheet and still be unusable to the import process. Microsoft’s current guidance calls for ANSI-format plain text and warns against using Excel to edit and save the Autopilot import file. Excel can introduce encoding, quoting, formatting, or value-conversion changes that are hard to see on screen.
Use a plain-text editor for the final inspection. Check the first line directly. Then inspect at least one complete data row without line wrapping. If the hardware hash spans visual lines only because the editor wraps long text, that is fine; if an actual newline divides the value, it is not.
3. Validate the records, not just the file
A syntactically valid file can still carry operational problems. Before import, check the batch for:
- Blank serial numbers or hardware hashes.
- Duplicate serial numbers inside the same file.
- Identical hardware hashes associated with different serial numbers.
- Unexpected group tags caused by copy-and-paste or reused templates.
- Assigned-user values from the wrong customer or tenant.
- Rows collected during different projects that were merged without source tracking.
Microsoft limits a multiple-device import file to 500 device rows. Operationally, a smaller batch is often easier to troubleshoot. If the source is uncertain, start with a handful of well-understood devices, confirm the result, and then increase the batch size.
4. Be deliberate with assigned users
The assigned-user column deserves more scrutiny than a basic domain check. Microsoft notes that the upload validation does not confirm that each individual UPN exists; it checks the domain. A mistyped username can therefore survive the first validation step and create a harder deployment problem later.
For every populated assigned-user value, verify the tenant, spelling, suffix, and deployment intent. If preassignment is not required, leave it empty and make the assignment through the normal administrative workflow later.
5. Run a final preflight
- Open the final file in a plain-text editor.
- Compare the header character-for-character with the supported schema.
- Confirm there are no extra columns or quotation marks.
- Count data rows and keep the file within the documented limit.
- Check blanks and duplicates in serial number and hardware hash.
- Review group tags and assigned-user values against the target tenant.
- Save the supported text format without spreadsheet reprocessing.
- Import a small known-good sample when the source or merge history is uncertain.
What a clean import does not prove
Successful acceptance does not prove that a device has the intended profile, dynamic-group membership, user assignment, or deployment readiness. It proves that the record entered the Autopilot registration workflow. After import, confirm the device record, profile status, group tag, and any assignment you expect to drive downstream behavior.