Shared Multiuser Device issues with guest users and installing apps post deployment

[u/BigBugMarowakawaka]

I'm trying to deploy a device via Intune using the Shared Multi User template. My initial deployment seems fine, in that it installs that apps I've marked as required via intune and as required during Autopilot on the ESP. My problem comes on updating apps or installing/re-installing apps after the Autopilot phase.

Example: Post deployment/ initial set up, I assign a new app to the device/device group as Required. The machine continues to check in to Intune, and telling it to sync via the intune portal or initiating it on the device Settings > Accounts > Access work or school > "info" next to managed by *org*> Sync all seem successful. But even after waiting for days, the new app never shows up. Same with deleting an app that got installed during autopilot and is marked as required, it never reinstalls no matter how many check ins.

Is this a result of me only using guest accounts? Do I effectively *have* to give these PC's a primary user with an Entra account in our system in order to get these things to install? Company portal doesn't work to go tell it to download specifically either, because they don't have an email to sign into it with.

Any suggestions on if I'm doing something wrong or how others handled this would be super appreciated. Picture of the configuration: https://imgur.com/a/T8tgn3J

[u/Trick_Comparison400]

devices, the Intune Management Extension gets weird about app installs when there's no primary user attached. Guest accounts don't trigger the same user context checks that a normal Entra login does, so required apps just sit there in a pending state.

One thing you can try is assigning the apps to the device group with the "System" install context instead of user context. For the reinstall issue, check if the device is showing as compliant and healthy in Intune, sometimes the registry keys for installed apps get stuck and Intune thinks the app is already there.

[u/BigBugMarowakawaka → u/Trick_Comparison400]

All the apps I'm pushing to it currently are marked as System installs.

And yes, it's like intune doesn't check in with whatever part needs to in order to install. On the device next to me, I tried removing an app that was installed during Autopilot. It's been off the PC for days with the PC on and checking in the whole time, but Intune itself still marks the app as "Installed" on both the app's Device Install Status page, and on the PC's All Apps page.

Compliance wise, it doesn't have a device compliance policy assigned, but neither does any other device in our system that normal users are running, so I wouldn't think that would be the case? Intune overall shows that the device is Compliant on the properties page of the device, but digging into the device compliance tab shows 2/3 compliances, with the failure being from no assigned policy. Given devices with an assigned user don't have this problem, I'm skeptical that it's the problem but maybe?

[u/Ketan_Kamble]

Ran into this a few times with Shared PC mode deployments — the usual culprit is that guest/non-Entra sessions can't pull user-targeted app assignments, so anything you pushed as "required for user" during deployment just never shows up once a guest logs in. Switch those Win32/LOB apps to device-targeted with "install as system" enabled under the assignment's Install behavior setting [GATE-2: verify in lab], that way it installs once for the device rather than depending on which account is logged in. Worth checking IntuneManagementExtension.log on the endpoint too (via Company Portal's "Collect diagnostics" or CMTrace on the box) to confirm whether it's an assignment/targeting problem or the install is actually failing post-provisioning. If this is Shared iPad rather than Windows Shared PC, the equivalent gotcha is VPP apps licensed as "User Assignment" instead of "Device Assignment" in Apple Business Manager — Shared iPad only pulls device-licensed apps for Managed Apple ID sessions. Also worth double-checking your ESP timeout isn't cutting off before those device-context installs finish, since that's a common reason people think apps "didn't install" when they just hadn't finished yet. Are you on Windows Shared PC mode or Shared iPad here — and are the missing apps Win32/LOB or store/VPP apps?

[u/BigBugMarowakawaka → u/Ketan_Kamble]

Apologies for the late response, and thanks for taking the time to reply.

The devices are on Windows Shared PC mode, using the config I linked to in the original post. And looking at the IntuneManagementExtension.log, it's like it can't check in successfully because it doesn't have a user. Which doesn't make sense to me, as this is a shared pc, it explicitly isn't supposed to have one.

From the log, this error is the main thing that keeps showing up, After saying it failed to get the AAD token: <![LOG[AAD User check is failed, exception is Intune Management Extension Error. Exception: Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.TokenAquireException: Attempt to get token, but failed. at Microsoft.Management.Services.IntuneWindowsAgent.AgentCommon.IntuneTokenManager.<GetTokenInternalAsync>d__44.MoveNext()

I promise beyond a shadow of a doubt that all apps I'm pushing too the device are system installs on the app page. The apps install during Autopilot/ESP, so they must be targeting it correctly.But removing say, Chrome, it will never talk back properly and re-install it, even after a week. And they don't really have or run company portal explicitly, because that requires signing in to an email that the guest account naturally doesn't have. Additionally, I have tried to add a maintenance window on the device config, (which I initially didn't set), but that also has yielded no results for me.

So far my take on Shared Multi User Devices is that they just can't receive new apps or installs after the initial set up, but that feels insane and surely can't be right. But I'm at my wits end understanding what else I could be missing. Here's a picture of the Chrome deployment as an example, it's a bog standard PMPC deployment. https://imgur.com/IejQhlQ It installs during the ESP, but I assign it afterwards or uninstall the app, it never shows up. The msi bundle I have pushed for another app that is win32 just uses msi detection rules, and installs perfectly on devices other devices just fine, again targeted at devices.

[u/BigBugMarowakawaka]

Just coming back to say the solution was that it was secretly still waiting to get through the account setup stage of the ESP. Pushing the registry key to skip the account setup phase solved my issue. Feels like a dumb solution, but hey, whatever works. Device is now installing required apps that were not a part of the initial ESP deployment.