In my previous article (here) we looked at Autopilot, what the benefits are for an organisation and how to configure it.
In this article we are going to look at the additional feature of the Enrollment Status Page (ESP) and how that enhances the default Autopilot for both the end user and IT administrators.
What is The Enrollment Status Page
What you may have noticed when we were performing our Autopilot Enrollment in the previous lab was that the end user was delivered to their desktop before the Intune Enrollment process was complete, and therefore before the compliance policies and applications that were targeted the the device or user were enforced. This is may seem like a trivial issue on the surface, and waiting for the policies to arrive is the resolution, but what if this did cause an issue.
What if an end user started to use the system before all of the applications that he/she needs are fully installed and configured? Chances are that they will open a ticket with the service desk with all of the overheads that entails. What if the user starts to browse the internet before your corporate security policies have been enforced? Then you are playing catchup in a security context, which is always bound to lead to some vulnerabilities.
The fact is end users, and IT professionals, expect devices to be ‘working’ when they are delivered.
To address this is Microsoft have introduced an Enrollment Status Page feature into Intune to allow the on boarding process to be controlled, and administrators have the ability to ‘lock’ the device until it has been deemed ready for end users to start using it.
Creating a User Group
Firstly, it is only possible to deploy any ESP profiles to user groups present within AzureAD. Therefore, we need to either select an existing group that contains out demo user(s) or create a new group. In this demonstration we will create a new group for this purpose.
Open the Azure Portal and navigate to Azure Active Directory > Groups and select New Group
Input the Group Type, Group Name, Group Description, Membership type and selected a single user account and click Create
Now we have a suitable group we can can now proceed to creating our custom ESP profile
Configuring the Enrollment Status Page
Like all Autopilot and Intune polices we first new to logon to the Azure portal, then navigate to Intune > Device Enrollment > Windows Enrollment > Enrollment Status Page
Here we can see that there is already a Default policy which is assigned to ‘All users and all devices’. This policy is created on all Intune tenants and as you can see by the description and configuration it is not configured to show the progress of the apps and profile installation.
We will therefore create our own Profile to configure the end user experience of the ESP exactly as we wish
Firstly, navigate to Intune > Device Enrolment > Windows Enrolment > Enrolment Status Page and select Create Profile
We will then complete the Name and Description of the Profile and clicking on Settings opens the settings of the Profile. Here, we can configure the ESP exactly as we wish. In my example I have enabled the features ‘Show apps and profiles installation progress‘, ‘Block device until all apps and profiles are installed‘ and selected my Office 365 app as an app that we have to wait for installation to complete
Then click ‘Save‘ to close the Settings blade, and ‘Create‘ to create the profile.
Now we have created our new profile we need to deploy it to the group that we created earlier. To do this click on the ‘Assign‘ button
Then click Select Groups, select the ‘ESP demo’ group we created earlier and click Select
And click Save to commit the changes
We have now completed the setup of the ESP and are now ready to commence testing of the End User experience
Enrollment Status Page experience
To test the ESP experience we need to first start a Windows 10 workstation that is registered in Autopilot and has been reset. I will not go through the details of how to set this up as I would be repeating my previous article.
Firstly, boot the workstation into the OOBE wizard and select the region
Select a keyboard layout
Select an additional keyboard if required
Now, because the device is registered for Autopilot the standard Autopilot experience will take over and prompt the user for credentials
Now we start to see our new ESP controlling the setup experience
This process can take some time because as we talked about at the start of this article the propose of the ESP is to ensure that all enrolment and deployment configuration is completed before the user is delivered to their desktop. Also, in this example we assigned Office 365 as an enforced app which, due to its size, can take some time to download/install depending on bandwidth and workstation performance.
Eventually though, we see that the users desktop is loaded, complete with Teams as Office 365 has been successfully installed.
And that concludes the demo of the Enrollment Status Page