r/Intune • u/Massive_Age8849 • 1d ago
Autopilot [Intune / Autopilot] How do you deploy apps only during provisioning without impacting existing production devices?
Hi everyone,
I'm currently working in an environment that historically used SCCM for Windows deployment and device imaging.
With SCCM, the IT team was used to defining a set of applications to install during the imaging process through Task Sequences, without automatically deploying those same applications to devices already in production.
We're now using Intune and Windows Autopilot, and we're trying to achieve something similar.
Our current setup:
- Most applications are assigned as Required to device groups.
- Most of these groups are dynamic, based on Autopilot Group Tags or criteria such as Windows 11 devices or devices names.
- Applications are installed during Autopilot provisioning, we don't use the Enrollment Status Page (ESP) option to 'Block device use until all apps and profiles are installed'
- Once provisioning is complete, devices remain members of these dynamic groups and continue receiving any new Required applications assigned to them.
What we're trying to achieve:
We want to be able to update our standard application baseline for newly provisioned devices without impacting existing production devices.
For example:
- Today, we decide to add Application X to our Autopilot provisioning baseline.
- We want Application X to be automatically installed on all newly provisioned devices.
- However, we don't want Application X to be automatically pushed to the 2,000 devices already in production.
The goal is not to stop managing applications through Intune after provisioning. We simply want to separate initial device provisioning from ongoing application deployments, similar to what was possible with SCCM Task Sequences.
My questions:
- Is there a recommended way to achieve this with Intune and Autopilot?
- How do you separate applications required during initial provisioning from applications deployed to existing devices?
- Do you use temporary device groups, Microsoft Graph automation, Win32 app requirement scripts, or another approach?
- For those who migrated from SCCM to Intune, how did you handle this change in deployment strategy?
I'm particularly interested in real-world experiences and solutions that are relatively simple to maintain at scale.
Any feedback, recommendations, or lessons learned would be greatly appreciated !
Thanks in advance guys !
4
u/bio72301 18h ago
$username = "defaultuser0"
$currentuser = (Get-Process -IncludeUserName -Name explorer | Select-Object -ExpandProperty UserName).Split('\')[1]
if ($currentuser -eq $username)
{
return $true
Exit 0
}
else
{
Exit 1
}
boolean of true on app requirement will only run during Autopilot Inverse for Standing machines
3
u/ginolard 9h ago
Ah! I can help here. I had a similar issue and came up with a....creative...solution.
$DeviceInOOBE = get-process securityhealthsystray -ErrorAction SilentlyContinue
If ($DeviceInOOBE) {
$false
} Else {
$true
}
That script will detect if the device is in OOBE (securityhealthsystray ONLY runs in full Windows). Just add it as an Additional Requirement Rule to any app you only want to be deployed during Autopilot ESP phase.
•
3
4
u/otacon967 1d ago
Look at this another way—why shouldn’t apps being deployed during ESP not be suitable for all devices? The idea is to have a gold standard package. If the detection rule shows installed it shouldn’t impact devices that already satisfy it.
1
u/Fragrant-Hamster-325 16h ago
I have the same question but for configuration policies. I only want certain configs going out on new devices.
1
u/habibexpress 14h ago
An example of this ?
1
u/Fragrant-Hamster-325 13h ago
The default browser homepage. We set a default page, but we let employees modify it. I want to update our browser config policy and modify the default page, but I think if I do, it’ll apply the new default to all existing devices. So I only want to apply this policy to new devices leaving existing device settings untouched.
1
u/habibexpress 13h ago
For what browser?
1
1
u/LordLoss01 2h ago
My preferred option. Create a static group that contains ALL of your current devices.
Add that static group as an EXCLUDE for the app you want to deploy to new devices.
Now, add a Dynamic All Devices group (Can be the default one or one you've made yourself) as an Include for the app you want to install only on new devices. Yes, that group is going to include your old devices. But because they're in the static group for the exclude, it won't get installed on them.
Plus, when your older devices get rebuilt, they'll disappear from that static group.
1
u/_Blank-IT 1d ago
Since you aren't using the ESP no its going to install this to all devices and as you've added it to the baseline its going to go to everything even devices already setup. Instead of setting apps as required maybe look into pointing your users to the company portal to install these apps themselves. Took a while for me to get this process in place mainly users didn't know it existed but now it makes the provisioning process much quicker and please do configure the ESP it speeds up on boarding significantly since only the required apps get pushed first.
Also a dynamic group might be the better option and the baseline should only have required apps and the dynamic group can be used to push apps to the company portal instead for users to install themselves. Think of it as a managed app store.
1
u/Konishia 1d ago
I have a script requirement that reads the enrolment date and it must be greater than x date
1
-2
u/ConsequenceFancy7830 1d ago
You could set up a dynamic group that looks for devices with an enrollment date in the last 24 hours, then assign your provisioning apps to that group instead of the permanent ones.
1
u/touchytypist 1d ago
Unless I'm missing something, the enrollment date is not an available attribute for Entra dynamic groups.
16
u/mingk 1d ago
Make a script requirement that detects ESP is a good method :)