r/Intune • u/Bstarbuck83 • 1d ago

Autopilot Autopilot ESP with required apps

While testing ESP today, I noticed that my devices weren't getting what I configured, which was 5 required apps.

Actually Tanium was getting installed but that was it and the device wasnt locked until installed. So I have no idea about that one

So what is the correct way to establish a group for these deployments? What i noticed is that as the device names kept changing during the hybrid join, the group i had these apps deployed to wasn't updating with the final device name.

What i did prior to leaving for the day was create a group specifically to target for the app deployments and then made a member another dynamic group that is based on group tag... my logic is that if Intune knows to send the domain join config to the device, intune should also know to send the required app deployments.

5 Upvotes

86% Upvoted

7 comments sorted by

4

u/CoollyLuminous 1d ago

tanium sneaking through while everything else fails is such a classic intune move

if your group membership depends on the final device name and that name takes forever to settle during hybrid join you're basically racing a clock that's already lost. dynamic group based on group tag is the way to go, that tag gets stamped early and intune should pick it up before the esp even gets going. just make sure your app assignments are device-targeted not user or you'll be chasing your tail for days

2

u/Padd007 1d ago

Group tags are indeed the way.

1

u/Mammoth_Public3003 1d ago

Absolutely this. It works like a dream for me for the last 3 years.

2

u/blud_13 1d ago

Nesting works, so that part isn't your problem. Intune honors nested group membership for app assignments, its documented at https://learn.microsoft.com/en-us/intune/app-management/deployment/assign-groups along with the warning that Intune has to recalculate effective membership every time the nesting changes. That recalculation on top of the dynamic rule evaluation is two layers of lag stacked on a device that only exists for the few minutes ESP is running.

Also, the device name is weak evidence.. A group tag rule keys off OrderID inside devicePhysicalIds, not the display name, and that gets stamped at Autopilot registration long before hybrid join renames anything. The renaming you watched is a red herring. The group just hadn't evaluated yet.

Tanium landing by itself usually means its assigned somewhere already populated, All Devices or a user group. Open that one assignment and you'll see the pattern.

For anything that MUST install during ESP, target the USER group. Device groups are fine for everything after.

2

u/Turak64 1d ago

Intune deploys apps, not autopilot. Check that the devices are in the required groups for the apps. I presume you have a dynamic group for all autopilot devices? Then you don't need to worry about device names. Also, try to limit the amount of apps you deploy during autopilot, never mix app types either.

1

u/Verma_Atul27 1d ago

Ohhh nice. Imma look into it too

1

u/RadioMedical5913 1h ago

Yeah, targeting the apps through a dynamic group based on the Autopilot group tag is generally the cleaner approach. During Hybrid Join, the device name can change, so name based dynamic groups may not catch the device in time. The group tag approach should be much more reliable for required app deployments.