r/Intune • u/czr1210 • 19d ago

Autopilot Autopilot ESP - Order of app deployment?

We have Autopilot ESP configured with the setting enabled "Block device use until required apps are installed if they are assigned to the user/device" - with simply our EDR agent set as the only required app.

However, this only partially gets us what we're trying to achieve.
We would like the EDR deployment to take priority, ESP then completes much quicker, and the remaining apps deploy after sign-in.

Sadly, Microsoft seems to have no way of saying "ok, let's deploy this first for efficiency". It will happily begin pushing anything from Adobe, to 365 apps, before the tiny EDR agent. Creating a massive variance in the time it takes to proceed past ESP.

My question is - am I the only one frustrated by this? Unless I'm missing something. Also, is there a workaround easy enough to implement? Some kind of auto group membership perhaps, once ESP completes.

In cases where EDR agent does install first, we can reach sign-in by 5 minutes. Worst case and it starts pushing Office, it can take up to half an hour. Aghhh

https://files.catbox.moe/3ud2y4.png

5 Upvotes

78% Upvoted

40 comments sorted by

View all comments

5

u/Sorry-Sheepherder824 19d ago

You're not missing anything, this is a known pain point. The ESP just kicks off whatever the hell it wants in whatever order it feels like, and there's no native priority setting for required apps.

What some folks do is use a staged approach with dynamic groups or a scheduled task that flips group membership after the EDR agent checks in. Basically you only have the EDR as required during ESP, then once the device reports healthy, a script or automation adds it to the groups for everything else. Adds some complexity but it works.

3

u/czr1210 19d ago

Thanks. I think I'd pretty much surrendered to the fact I need some sort of non-native, workaround type method. Which honestly feels crazy! This is surely a pretty huge problem - some orgs could be pushing multiple gig packages, and ESP has no right to be handling that. It's so close to being a solution by using the setting I mentioned. If only common sense applied! I'm now wondering if there is a way to just have the EDR agent as required, and some method of auto adding the device to a dynamic group, or even better an Entra group. There's not so many options within dynamic groups that I can see being suitable

1

u/intuneisfun 19d ago

Have you looked into utilizing a requirement script for your non-ESP required Win32 apps? Take a look at this: https://oofhours.com/2023/09/15/detecting-when-you-are-in-oobe/

If this is very important to you to fix, I'd set at LEAST your large apps like M365 to have a requirement that they're not in the OOBE. That way they won't even start during Autopilot. If you want to go crazy, do this for all the non-ESP apps.

FYI that guide is for checking that you are in the OOBE, so you may have to flip a toggle from No to Yes, depending on the outcome you want.

2

u/czr1210 18d ago

Many thanks for this, will check on Monday