The first user that signs in needs to have Microsoft Entra join permissions for some deployment scenarios. For details, see Allow users to join devices to Microsoft Entra ID. The exception to this requirement is Windows Autopilot self-deployment mode since this method works in a userless context.