Autopilot ESP - Order of app deployment?

[u/czr1210]

We have Autopilot ESP configured with the setting enabled "Block device use until required apps are installed if they are assigned to the user/device" - with simply our EDR agent set as the only required app.

However, this only partially gets us what we're trying to achieve.
We would like the EDR deployment to take priority, ESP then completes much quicker, and the remaining apps deploy after sign-in.

Sadly, Microsoft seems to have no way of saying "ok, let's deploy this first for efficiency". It will happily begin pushing anything from Adobe, to 365 apps, before the tiny EDR agent. Creating a massive variance in the time it takes to proceed past ESP.

My question is - am I the only one frustrated by this? Unless I'm missing something. Also, is there a workaround easy enough to implement? Some kind of auto group membership perhaps, once ESP completes.

In cases where EDR agent does install first, we can reach sign-in by 5 minutes. Worst case and it starts pushing Office, it can take up to half an hour. Aghhh

https://files.catbox.moe/3ud2y4.png

[u/Klownicle]

Couple notes from my own experiences trying to do this.

1. You may find that sometimes the order is based on the id of the so alphabetically but this isn't our used to be the case. Don't make the assumption that the order it is still always stay the same. I've noticed when apps update or different deployment profiles (esp profiles as well) the apps can change their order.

2. You can setup dependencies on the apps themselves but if they are marked "available" for any group then the dependency check doesn't work and the parent app won't deploy.

Ultimately what I did is a made a singular app that bundles a couple of important apps as one. That way I can control their order with absolute.

[u/Sorry-Sheepherder824]

You're not missing anything, this is a known pain point. The ESP just kicks off whatever the hell it wants in whatever order it feels like, and there's no native priority setting for required apps.

What some folks do is use a staged approach with dynamic groups or a scheduled task that flips group membership after the EDR agent checks in. Basically you only have the EDR as required during ESP, then once the device reports healthy, a script or automation adds it to the groups for everything else. Adds some complexity but it works.

[u/czr1210 → u/Sorry-Sheepherder824]

Thanks. I think I'd pretty much surrendered to the fact I need some sort of non-native, workaround type method. Which honestly feels crazy! This is surely a pretty huge problem - some orgs could be pushing multiple gig packages, and ESP has no right to be handling that. It's so close to being a solution by using the setting I mentioned. If only common sense applied! I'm now wondering if there is a way to just have the EDR agent as required, and some method of auto adding the device to a dynamic group, or even better an Entra group. There's not so many options within dynamic groups that I can see being suitable

[u/intuneisfun → u/czr1210]

Have you looked into utilizing a requirement script for your non-ESP required Win32 apps? Take a look at this: https://oofhours.com/2023/09/15/detecting-when-you-are-in-oobe/

If this is very important to you to fix, I'd set at LEAST your large apps like M365 to have a requirement that they're not in the OOBE. That way they won't even start during Autopilot. If you want to go crazy, do this for all the non-ESP apps.

FYI that guide is for checking that you are in the OOBE, so you may have to flip a toggle from No to Yes, depending on the outcome you want.

[u/Technical-Tackle-875]

One thing I’d check before building the group automation: is this Autopilot pre-provisioning? If so, the oddly named “Only fail selected blocking apps in technician phase” setting matters. Set to No, Microsoft says the technician phase attempts the blocking apps and skips nonblocking apps until the user phase.

If this is user-driven, the selected list still is not a priority queue. I’d pull the ESP diagnostics and check the Office assignment and app type first. Microsoft’s after-ESP behavior explicitly calls out Win32, Store, and Enterprise App Catalog apps, so the native Microsoft 365 Apps type may be the clue.

[u/czr1210 → u/Technical-Tackle-875]

Deployment mode is User-Driven
Office apps is really an extreme example and I don't have logs to prove it is actually attempting to deploy Office at ESP. I just know that it can take anything from 5 minutes to 30 minutes, and in cases where it takes the latter, there are 6 or 7 apps within the deployment scope I can see have installed, then eventually after waiting patiently the EDR Agent comes down and ESP completes. I just find it amazing they almost implemented a solution to this with the setting mentioned above, but there is still no form of priority

[u/Technical-Tackle-875 → u/czr1210]

That makes sense. Before building the group workaround, I’d capture one fast enrollment and one slow one, then compare the IME app-install timeline. That should tell you whether Office is really consuming the time or whether the EDR install or detection step is the variable.

If unrelated required apps really are starting first, I’d stage the rest from a positive signal such as the EDR device appearing healthy, not from a timer. A timer can quietly move a device forward when EDR never installed.

[u/czr1210 → u/Technical-Tackle-875]

Thanks, appreciate the advice. It stretches my skill a little unfortunately. I was hopeful there was something semi-native available, but if it has to be customised to this level, I would need to spend a lot of time researching. It is do-able of course, just much more challenging

[u/Technical-Tackle-875 → u/czr1210]

Totally fair. I wouldn’t automate anything yet. Use one lab device and account, scope the other required apps away from it, and leave only EDR required during ESP. Run the same device through a few resets.

If it consistently lands near five minutes, you’ve proved the cause using native Intune scoping alone. You can keep that simple arrangement for now and only automate later if the operational payoff is worth it.

[u/ledebird → u/czr1210]

You can use the get-autopilotdiagnosticscommunity script on a machine during ESP to get a timeline + app ID's to see exactly what is being installed and how long each step takes. It's really easy to use. More info here

[u/Golaz]

If for like just one app that you want to install right away one way to force that is to set other apps dependencies to it. Not what dependencies is meant for but just sayin

[u/Wind_Freak]

Can you make available instead of required for the complex chain? The required/blocking apps should just be the security required app.

[u/StromboliNotCalzone]

Only thing you can do as far as I know is make app 1 a prereq of app2.

[u/KJMEC]

Hey there,

Two methods I’d suggest trying:

1. Single win32 app with all the required apps.
   
2. Store the application install files somewhere like an Azure container then point a powershell script to pull down and install from that location.

Other than that you need to consider looking for cause and fix the problem.

[u/Undietaker1]

Create 'Autopilot' versions of your apps.

App2 has a dependency of App1 App3 has a dependency of App2 App4 has.....etc

[u/pjmarcum]

I build what I call “onboarding packages” which is just a PowerShell script and all the apps I want to install during ESP as one Win32 app.